> This page is for Gateway.

> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.merge.dev/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.merge.dev/_mcp/server.

# Geo-location routing

> Restrict which vendors serve your requests by country, region, or vendor, for the whole organization or per project and customer. Covers region tags, allow and deny lists, and the error when nothing matches.

Geo-location routing limits which vendors serve your requests, by location or by vendor. Use it for EU-only routing, to exclude CN-hosted vendors, or to keep a vendor out until its sub-processors are approved.

## How vendors are tagged

Each vendor has a `country_code` (ISO 3166 alpha-2, such as `US` or `FR`) and a `geo_region` (such as `NA`, `EU`, `APAC`, or `CN`). A region token matches either tag. [Vendor terms](/merge-gateway/security/provider-terms) lists each vendor's tags; the dashboard offers only tokens current vendors carry.

## Configure restrictions

In **Configure → Request settings → Routing restrictions** ([dashboard](https://gateway.merge.dev/configuration/routing-restrictions)), vendors and regions each offer **All**, **Only selected**, or **All except selected**. Changes need Manage organization settings and are recorded in the [audit trail](/merge-gateway/security/audit-trail) as `ORG_SETTINGS_UPDATED`.

| Setting                      | Field             | Effect                                                                         |
| ---------------------------- | ----------------- | ------------------------------------------------------------------------------ |
| Regions: Only selected       | `allowed_regions` | Only vendors matching a token are eligible. Vendors with no tags are excluded. |
| Regions: All except selected | `ignored_regions` | Vendors matching a token are excluded. Vendors with no tags are kept.          |
| Vendors: Only selected       | `allowed_vendors` | Only these vendors are eligible                                                |
| Vendors: All except selected | `ignored_vendors` | These vendors are excluded                                                     |

A list can't share entries with its opposite, and unknown vendor slugs or region tokens are rejected on save. Restrictions apply to every model a request or routing policy tries, including BYOK traffic. They restrict where data is sent, not where requests come from.

## Per project and customer

Projects and end customers can override these lists and [zero data retention](/merge-gateway/security/zero-data-retention) on their **Controls** tab or with `PUT /v1/projects/{id}/controls` and `PUT /v1/customers/{id}/controls`. `{"allowed_regions": ["EU"]}` makes one project EU-only. An override replaces the organization's list rather than merging. [Scoped controls](/merge-gateway/security/zero-data-retention#scoped-controls) covers resolution order, who can relax a control, and the request format.

The controls API also accepts `vendor_routing_preference`, a preferred-vendor list that reorders eligible vendors without excluding any, so it never fails a request.

## When no vendor matches

If restrictions leave a model with no eligible vendor, Gateway returns:

```json
{
  "error": {
    "type": "invalid_request_error",
    "message": "Model 'openai/gpt-5.5' has no vendor matching this organization's vendor or region restrictions.",
    "code": "vendor_restrictions_unavailable",
    "param": "model"
  }
}
```

In a fallback or intelligent routing policy, that target is skipped for the next. With ZDR on, this can return `zdr_vendor_unavailable` instead.

## Next steps

#### [Zero data retention](/merge-gateway/security/zero-data-retention)

Route only to vendors with zero data retention agreements

#### [Vendor terms](/merge-gateway/security/provider-terms)

Each vendor's country, region, and terms

#### [Per-customer restrictions](/merge-gateway/security/per-customer-restrictions)

Block or pin models per customer