Pick the model by the provider's jurisdiction

Your EU customers are fine with a hosted model. They're not fine with a hosted model whose operator sits outside the EU. The distinction matters to their DPO, so it has to matter to your architecture.

Hoody AI's gateway runs on your host and logs no prompt content, but on paid models the upstream provider still receives the prompt. So for these customers you skip the catalog and bring your own provider: point the agent's provider config at an EU-headquartered model company, with a key you hold. The prompt then makes exactly one hop off your Frankfurt box, to a company inside the same jurisdiction, under a contract you signed.

The app code doesn't change between customer segments. The provider entry does.

Model choice becomes a jurisdiction choice, and it's a config field.