# Restricted territories

LowRouter is operated by an EU company and routes to providers that set
their own geographic rules. Two kinds of restriction follow from that:

- **Sanctioned territories**, where the service isn't available at all.
- **Provider exclusions**, where one provider's terms rule out end users
  in a territory. Requests from there are never routed to that provider,
  and other providers still serve the request.

Both apply to the **end user** of a request, which is not always the
account holder. If you build on LowRouter, your terms with your own users
have to carry the same restrictions. Using a VPN or proxy to get around
them breaches the [terms of service](/terms).

## Sanctioned territories

These are blocked on every model, under comprehensive EU and UN sanctions
and EU Regulations 833/2014 (Russia) and 765/2006 (Belarus):

| Territory | Code |
|---|---|
| Cuba | `CU` |
| Iran | `IR` |
| North Korea | `KP` |
| Syria | `SY` |
| Russia | `RU` |
| Belarus | `BY` |
| Crimea | `UA-43` |
| Sevastopol | `UA-40` |
| Donetsk region | `UA-14` |
| Luhansk region | `UA-09` |

A request from one of these territories gets a `451` on every endpoint.
An account cannot be created there, and a billing country on this list
cannot buy credits.

## Provider exclusions

Each row below is a provider's own rule. A request from a listed
territory is not routed to that provider:

- With an `auto/` id, the other providers of the model still compete for
  it.
- With a full `{provider}/…` id pinned to the restricted provider, the
  request gets a `451`.
- When no route is left, the request gets a `451` too.

| Provider | Applies to | Excluded end-user locations | Source |
|---|---|---|---|
| `anthropic` | every model | Anywhere not on Anthropic's supported list, including China (with Hong Kong and Macau), Venezuela, Myanmar, Afghanistan, Yemen and Kosovo. Ukraine's Kherson (`UA-65`) and Zaporizhzhia (`UA-23`) regions are excluded too. | [Supported regions](https://www.anthropic.com/supported-countries) |
| `vertex`, `aws-bedrock`, `deepinfra` | Claude models | Same as `anthropic` | [Supported regions](https://www.anthropic.com/supported-countries) |
| `openai` | every model | Anywhere not on OpenAI's supported list, including China (with Hong Kong and Macau) and Venezuela | [Supported countries](https://developers.openai.com/api/docs/supported-countries) |
| `aws-bedrock` | OpenAI models | Same as `openai` | [Supported countries](https://developers.openai.com/api/docs/supported-countries) |
| `aws-bedrock` | Cohere models | China, Hong Kong, Macau | Cohere EULA, "Restricted Location" |
| `google` | every model | Anywhere not on Google's Gemini API list, including China (with Hong Kong and Macau), Myanmar and Afghanistan | [Available regions](https://ai.google.dev/gemini-api/docs/available-regions) |
| `deepinfra` | Gemini models | Same as `google` | [Available regions](https://ai.google.dev/gemini-api/docs/available-regions) |
| `meta` | every model | China (with Hong Kong and Macau), Afghanistan, Cambodia, Eritrea, Ethiopia, Haiti, Iraq, Libya, Myanmar, Nicaragua, Pakistan, Somalia, Venezuela, Western Sahara | [Geographic use policy](https://dev.meta.ai/legal/geographic-use-policy) |
| `meta` | Muse Image | India, in addition to the row above | [Geographic use policy](https://dev.meta.ai/legal/geographic-use-policy) |
| `tensorx` | every model | Myanmar, plus the FATF "call for action" jurisdictions that the sanctioned list above already covers | TensorX terms §17 |

Every other provider requires sanctions compliance only, which the first
table covers.

Providers change these lists without notice. We re-check them before
every release and update this page with them. The page's date shows the
last review.

## How we locate a request

We read the location of each request from its IP address, using
[DB-IP](https://db-ip.com)'s IP to City Lite database (CC BY 4.0),
refreshed monthly. Subdivision codes such as `UA-43` come from the same
database.

An address the database can't place, such as a private range or an
unmapped block, restricts nothing. For accounts, we also use the billing
country Stripe verifies at checkout. The IP address itself is used only
for this check, and logs record the territory, not the address.

## What the API returns

A request from a sanctioned territory:

```json
{
  "error": {
    "type": "permission_error",
    "message": "LowRouter is not available in your region (IR). See https://lowrouter.ai/docs/guides/restricted-territories/",
    "code": "unavailable_for_legal_reasons"
  }
}
```

A model whose remaining routes all exclude the caller's territory:

```json
{
  "error": {
    "type": "permission_error",
    "message": "auto/meta/muse-spark-1.3 is not available in your region (CN): provider terms exclude that territory — see https://lowrouter.ai/docs/guides/restricted-territories/",
    "code": "unavailable_for_legal_reasons",
    "param": "model"
  }
}
```

Retrying won't help. The [errors reference](errors#451-not-available-in-your-region)
covers both responses.