Which LLM API can you actually use for compliance?

Security reviews ask the same questions every time: SOC 2 or ISO 27001? Will they sign a HIPAA BAA? Can we turn off data retention? Do they train on our prompts? Can data stay in the EU? We read the trust centers, docs and terms of 21 LLM API providers and wrote down what each one publishes, with the exact quote and a link to the page. Where a provider publishes nothing, we say so instead of guessing. This is a starting point for your review, not an audit or legal advice.

Tap a box to filter by it; tap it again to remove that filter. Filters combine.

21 of 21 providers. Documented claims from each provider's own pages, not an audit or legal advice.

At a glance

• 5 providers say they keep no prompts or outputs by default, and 3 more let you switch zero data retention on yourself. See all with zero retention.
• 10 say API data is not used for training by default. See them.
• 3 publicly offer a BAA or call the service HIPAA eligible; 8 more list HIPAA or take BAA requests. See them.
• 4 list ISO/IEC 42001, the AI management system standard. See them.
• 5 offer EU data residency for at least some models, taken from our price tracker's provider registry. Full EU residency.

Labels such as "on request" or "self-serve" are our summary of the quoted text; open a provider to read the quote and the source. See the methodology.