Capability · Data modes

Decide what leaves before it leaves.

Decide how much of the file is allowed to leave, before it leaves. Most teams never need to send a single row.

Rows, in schema-only: ≤ 3
Characters per cell: ≤ 80
PHI routing, under a BAA: +20%

The job

The question legal asks first.

Before any of this is useful, somebody has to answer what exactly leaves the building — and “the file” is not an answer that gets signed off. Usually the mapping work stalls there, in a thread with counsel, for a fortnight.

What changes

Schema-only sends your column names and at most three sample rows, each cut to 80 characters, enforced at the HTTP edge and again at the model boundary by one function. Full-data is a separate switch. PHI routing is a third, locked behind a BAA you accept in-app.

What you get

Not a demo. The thing that runs every day.

Schema-only

Headers and three clamped rows

The default. Only your column names plus up to three sample rows, each cut to 80 characters, ever cross the boundary — so raw records never leave you and a DPA usually is not needed.

HowclampForSchemaOnly() in lib/parser.ts is rows.slice(0, 3) with each cell truncated at 80 characters, and it is the single chokepoint every schema-only path shares — enforced again at the HTTP edge in each route that takes sample rows.

Full-data

Row-level AI, entitled not defaulted

Unlocks row-level AI and unstructured convert. It is tied to the PHI entitlement, so widening the exposure is always a deliberate, contracted act.

HowA full-data request without the entitlement returns 402 phi_gateway_required — the request is refused, not quietly downgraded into something that looks like it worked.

Routing

Standard is what an unconfigured workspace gets

PHI routing is a third, orthogonal axis, resolved per run from the request and falling back to the workspace setting. Since September 2026 that default is standard.

HowresolveRunPhi() in lib/agreements.ts reads phi_mode from the body, then tenants.phi_mode — which now defaults to false. Every fail-soft path defaults to STANDARD on an unreadable settings row: unknown traffic is never silently upgraded.

BAA gate

PHI stays locked until you sign

Asking for PHI routing without an accepted agreement is refused with a pointer to the page that unlocks it — never a silent downgrade to the general catalogue.

How403 agreement_required carries the agreement kind, its version and a settings_url. Production runs MAPR_BAA_ENFORCE=strict, so every PHI-routed run needs an acceptance on file — and the read FAILS CLOSED if the store is unreachable.

Price

The surcharge follows the routing you got

PHI routing adds 20% to the whole map charge, flat fee included. If a run is downgraded to standard for any reason, you are billed at the standard rate and told.

HoweffectiveRunPhi() in lib/reshapeBilling.ts bills the routing the run ACTUALLY got, not the workspace policy, and a downgraded run carries a phi_downgraded audit flag plus a user-visible warning. Charging a BAA premium for a run that bypassed the BAA gate is a claim we will not make.

Unchanged

The mapping logic is the same either way

Both modes run the identical six-layer cascade, and every layer but two runs inside the Worker. What changes between the modes is only what the metered layer is permitted to see — so behaviour you tested on schema-only carries over.

HowA standard run still keeps the workspace REGION pin: routing picks the model catalogue, the region picks where compute may run. Zeroing the region on standard runs once 422'd every standard code-strategy reshape — the two are separate knobs and stay separate.

How it works

The two axes, side by side

The same cascade runs whichever mode you are in. Two independent things change around it. EXPOSURE — schema-only versus full-data — decides how much of your data may leave at all. ROUTING — standard versus PHI — decides which catalogue and which region the metered call lands in. They are orthogonal on purpose: minimizing data and signing a BAA are different decisions.

01
Resolve the exposure
mode is schema-only unless you say otherwise. full-data is tied to the PHI entitlement, so widening what may leave is always a contracted act.
02
Clamp at one chokepoint
clampForSchemaOnly() cuts the grid to three rows of ≤80 characters — and every route that accepts sample rows enforces the same cap again at the HTTP edge.
03
Resolve the routing
resolveRunPhi() reads phi_mode from the request, then tenants.phi_mode. Every fail-soft path defaults to STANDARD: an unreadable settings row can never upgrade unknown traffic.
04
Gate, then price
An explicit PHI ask with no accepted agreement is refused with a pointer to the page that unlocks it. The +20% then follows the routing the run actually got, not the policy it asked for.

	Schema-only	Full-data
What leaves your system	Headers + ≤3 rows, each ≤80 chars	Row values, to the metered layer-5 call
Row-level AI	No	Yes
Unstructured convert (image / PDF / audio / web)	No	Yes
Entitlement	None — it is the default	402 phi_gateway_required
DPA	Usually not needed — data-minimized	Yes, under BAA coverage
Cascade layers 1–3 and 4	In-process	In-process
Cascade layer 3½ (our matching model)	Column names + a computed profile leave the Worker to our own GPU in Switzerland — never cell values	Same: names and profile only, never rows
Price	Flat per-map fee from the prepaid wallet	Flat fee + AI tokens at provider cost × 2 (× 0.5 with your own key)
PHI routing (either mode)	Optional, +20%, BAA-gated	Optional, +20%, BAA-gated

Exposure and routing are independent. A schema-only run can be PHI-routed, and a full-data run is not automatically PHI-routed — except for unstructured convert, which is PHI-routed by construction. Both modes share the same input clamp and the same in-process cascade.

Try it

What a refusal looks like

Ask for PHI routing before the workspace has accepted the agreement and you get a 403 that names the agreement and the page that unlocks it — the one thing a compliance gate must never do is open quietly.

curl

curl -i https://api.adaptivmapr.com/v1/reshape \
  -H "Authorization: Bearer $MAPR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "upload_id": "upl_7fce…",
    "target":   { "template_id": "lab_results_v1" },
    "mode":     "full-data",
    "phi_mode": true
  }'

response

HTTP/1.1 403 Forbidden

{
  "error": {
    "code": "agreement_required",
    "message": "PHI / enterprise routing requires an accepted agreement for this workspace",
    "agreement": {
      "kind": "phi_baa",
      "version": "phi-1.0",
      "title": "PHI & Confidential Data Processing Agreement"
    },
    "settings_url": "/dashboard/settings?tab=security#agreements"
  }
}

→ refused, not downgraded · accepting is one click in Settings → Security & Data

There is no free tier. Every map draws the flat per-map fee — about $0.001 — from a prepaid wallet with a $10 minimum top-up, including a fully deterministic map and a layout cache hit that used no AI at all.
Layers 4 and 5 are config-gated. Without MAPR_EMBEDDING_API_KEY / MAPR_LLM_API_KEY the cascade runs on the deterministic layers alone rather than failing — quietly weaker, never quietly broken.
Unstructured convert is always PHI-routed. Asking to keep it on standard routing is refused with 400 phi_required_for_full_data, because misreporting the routing would misreport the price too.

The surface

Every route this page actually has.

Both axes are request fields on every mapping route — `mode` and `phi_mode` — plus a small set of surfaces for reading and changing the workspace default. Accepting an agreement is deliberately dashboard-only: a bearer key must not be able to sign a legal document.

GET/v1/me/agreementsWhich agreements this workspace has accepted, at which version, and what is still outstanding.dashboard only
POST/v1/me/agreementsAccept the BAA / confidentiality terms in-app. This is what unlocks PHI routing — one click in Settings → Security & Data.dashboard only
GET/v1/me/workspace/settingsRead the workspace defaults, phi_mode among them. Bearer key or session cookie.admin scope
PATCH/v1/me/workspace/settingsChange the workspace default routing. It stays gated: flipping the setting does not bypass the signed-agreement check.admin scope
GET/v1/usageCurrent-period row counts plus per-cascade-layer hit counts — how much of your traffic ever reached the metered layer.read scope
GET/v1/pricingThe per-model, per-token rate card in micro-USD, optionally per jurisdiction.read scope

Limits & failure modes

What it refuses to do — and the code it says it with.

This page is mostly refusals by design. A data-exposure control that degrades gracefully into more exposure is not a control.

402 phi_gateway_required

full-data asked for without the entitlement on the workspace.

Refused, not downgraded to schema-only. A silent downgrade would return something that looks like it worked while answering a different question.

403 agreement_required

An explicit PHI ask with no acceptance on file.

Carries the agreement kind, its version and a settings_url. Production runs MAPR_BAA_ENFORCE=strict, so every PHI-routed run needs an acceptance — and the read fails CLOSED.

400 phi_required_for_full_data

Unstructured convert input asked to stay on standard routing.

An image or a PDF is full-data by nature; there is no clamped version of a scan. Standard routing there would be a claim we could not keep.

phi_downgraded

A run asked for PHI routing but the execution path could not honour it.

Billed at the STANDARD rate, with an audit flag and a user-visible warning. Charging a BAA premium for a run that bypassed the BAA gate is a claim we will not make.

Standard keeps the region

You switch a workspace from PHI to standard routing.

Routing picks the model catalogue; the region pin picks where compute may run. They are separate knobs — zeroing the region on standard once 422’d every standard code-strategy reshape.

Layers 4 & 5 config-gated

A deployment with no embedding key or no LLM key.

Both fail soft to OFF. Neither mode changes that: what a mode controls is what the metered layer may SEE, not whether it exists.

What it costs

One prepaid wallet, drawn down per call.

No free tier. Top up from $10 — the balance is shared across the phi-cloud suite — and every operation draws it down at the rate below. An optional $6/mo plan grants a credit that resets each billing cycle instead; overage falls back to the wallet.

Minimum to start

$10

A prepaid token wallet, shared across the phi-cloud suite. There is no free tier, no seats and no contract.

Every map, both modes

$0.001

The flat per-map fee. Schema-only avoids the token-metered AI cost, not the fee — a deterministic map and a cache hit both draw it.

PHI routing

+20%

On the whole charge, flat fee included, and only on the routing the run actually got. Locked until the workspace accepts the BAA in-app.

A PHI/enterprise-routed run multiplies the whole charge by 1.2 (+20%), flat fee included — and only when the run genuinely got that routing. PHI stays locked until the workspace accepts the BAA in Settings → Security & Data. Full pricing

Questions

The ones asked before signing.

What it costs, what leaves your network, and the claims we will not make.

What exactly leaves my system in schema-only mode?

Your column headers and at most three sample rows, each truncated to 80 characters. That is enforced at one chokepoint in the parser and again at the HTTP edge of every route that accepts sample rows, so schema-only logic cannot accidentally ship more. No full rows leave, which is why a DPA usually is not needed.

Is schema-only a free tier?

No. There is no free tier. Schema-only is a data-minimization mode, and every map still draws the small flat per-map fee from your prepaid wallet — a deterministic map and a cache hit included. What schema-only avoids is the token-metered AI cost, not the fee.

Why is full-data gated behind an entitlement?

Because letting row values reach a model should be a deliberate, contracted choice. It is tied to the PHI entitlement so that BAA coverage and in-region routing are in place first, and a request without it returns 402 rather than quietly sending your data.

Is PHI routing on by default?

No. Since September 2026 a workspace defaults to standard routing, and PHI is an explicit opt-in in Settings → Security & Data, alongside accepting the BAA. Every fail-soft path also defaults to standard, so an unreadable settings row can never upgrade unknown traffic into the surcharge and the agreement gate.

What does PHI routing actually change?

Only the metered layer-5 call, which is sent with X-PHI and X-Region so phi-cloud forces a PHI-eligible model resident in your jurisdiction under a BAA. Layers 1–4 never leave the process in either mode. It adds 20% to the whole map charge — and only when the run genuinely got that routing.

Keep reading

The rest of the same engine.

Schema mapping Any-to-any convert Validators

One key, from a messy file to your schema.

Top up a $10 prepaid wallet and start mapping. In schema-only mode only your headers and three clamped rows ever leave you.

Get an API key Read the docs