Methodology

What this is

A list of what 21 LLM API providers publish about their compliance, collected on 2026-10-29. It is meant to save the first hour of a vendor security review. It is not an audit, a certification check or legal advice: we don't see the audit reports, and terms change. Always confirm with the provider and read their contract.

Where the data comes from

• Only the provider's own pages: trust centers, security pages, API docs, terms and privacy policies (plus the official Google Cloud blog for Vertex AI FedRAMP High).
• Every HIPAA, zero data retention, training and retention entry carries a verbatim quote and the page it came from. A script checks that each quote still appears in the saved copy of that page.
• Certifications are listed as the trust center or security page lists them. "Company-wide" means the provider lists it for its whole cloud (Google Cloud, Cloudflare, Nebius); the scope may not include every AI product. GDPR and CCPA are laws, not certificates, so they don't count in the certification filter.
• Headquarters and EU data residency come from the BranoLabs LLM price tracker registry, which only lists a headquarters with an official imprint, terms, privacy policy or registry source.
• "Not published" means we found no statement on the pages we checked. It doesn't mean the answer is no.

The labels

HIPAA

• BAA / HIPAA eligible: The provider says it signs a Business Associate Agreement or that the service is HIPAA eligible.
• BAA on request: The provider asks you to contact them or fill in a form to discuss a BAA.
• Listed in trust center: HIPAA is listed in the provider's trust center or report, without public BAA terms.

Zero data retention

• Zero retention by default: The provider says it does not store prompts and outputs by default.
• Self-serve setting: You can switch on zero data retention yourself in the console or settings.
• Configurable: Zero retention is possible with specific settings described by the provider.
• Offered: The provider advertises zero retention of inputs and outputs, without public setup details.
• On request / approval: You have to ask; the provider approves zero data retention case by case.
• Routing filter: A router setting that only sends requests to providers that declare zero retention.
• Not guaranteed: The provider says this product does not guarantee zero retention.

Training on API data

• Not used for training by default: The provider says API data is not used to train models unless you opt in.
• Not used on paid tier only: Paid usage is not used for training, but free-tier usage is.
• Used unless you opt out: The provider may use API data for training; you can opt out.
• Depends on the routed provider: A router: training depends on the underlying provider and your routing settings.
• Unclear for API data: The published policy does not separate API customer data.

Not included yet

Providers whose pages we couldn't read reliably (for example Scaleway and IONOS) are left out rather than guessed. Data is checked again when providers change their trust pages; the JSON API has a last-checked date per provider.

Use the data

/api/providers.json (CC BY 4.0) and llms.txt. Back to the table.