{"updated":"2026-10-29","source":"https://compliance.branolabs.com","license":"CC BY 4.0","note":"Documented claims from each provider's own public pages, each with a source URL and verbatim quote. null means not published on the pages we checked, not 'no'. Not an audit or legal advice.","count":21,"providers":[{"slug":"amazon-bedrock","name":"Amazon Bedrock","page":"https://compliance.branolabs.com/p/amazon-bedrock","trust_center":"https://aws.amazon.com/bedrock/security-compliance/","certifications":[{"name":"ISO","source":"https://aws.amazon.com/bedrock/security-compliance/","scope":"product","note":"AWS lists Bedrock as in scope for ISO"},{"name":"SOC","source":"https://aws.amazon.com/bedrock/security-compliance/","scope":"product","note":"AWS lists Bedrock as in scope for SOC"},{"name":"CSA STAR Level 2","source":"https://aws.amazon.com/bedrock/security-compliance/","scope":"product","note":null},{"name":"FedRAMP High","source":"https://aws.amazon.com/bedrock/security-compliance/","scope":"product","note":"In the AWS GovCloud (US-West) Region"}],"hipaa":{"status":"baa","quote":"is HIPAA eligible","source":"https://aws.amazon.com/bedrock/security-compliance/","quote_verified":true},"training_on_api_data":{"status":"no","quote":"Because the model providers don't have access to those accounts, they don't have access to Amazon Bedrock logs or to customer prompts and completions.","source":"https://docs.aws.amazon.com/bedrock/latest/userguide/data-protection.html","quote_verified":true},"zero_data_retention":null,"retention":null,"dpa":null,"hq_country":"US","eu_data_residency":"partial","residency_notes":"Per-model, per-region pricing; several models are priced in EU regions (Frankfurt, Ireland, Milan, Stockholm). Check each model.","residency_source":"https://aws.amazon.com/bedrock/pricing/","prices":"https://prices.branolabs.com/providers/amazon-bedrock","last_checked":"2026-10-29"},{"slug":"anthropic","name":"Anthropic (Claude API)","page":"https://compliance.branolabs.com/p/anthropic","trust_center":"https://trust.anthropic.com/","certifications":[{"name":"SOC 2 Type 2","source":"https://trust.anthropic.com/","scope":"product","note":null},{"name":"ISO/IEC 27001:2022","source":"https://trust.anthropic.com/","scope":"product","note":null},{"name":"ISO/IEC 42001:2023","source":"https://trust.anthropic.com/","scope":"product","note":null},{"name":"CSA STAR","source":"https://trust.anthropic.com/","scope":"product","note":null},{"name":"NIST 800-171","source":"https://trust.anthropic.com/","scope":"product","note":null},{"name":"FedRAMP High","source":"https://trust.anthropic.com/","scope":"other","note":"Claude for Government only, not the regular Claude API"}],"hipaa":{"status":"baa","quote":"Anthropic offers two data handling arrangements for the Claude API: zero data retention (ZDR) and HIPAA readiness","source":"https://docs.claude.com/en/docs/build-with-claude/zero-data-retention","quote_verified":true},"training_on_api_data":{"status":"no","quote":"Anthropic may not train models on Customer Content from Services.","source":"https://www.anthropic.com/legal/commercial-terms","quote_verified":true},"zero_data_retention":{"status":"on_request","quote":"To request ZDR for your organization, contact the Anthropic sales team","source":"https://docs.claude.com/en/docs/build-with-claude/zero-data-retention","quote_verified":true},"retention":{"text":"Deleted within 30 days","quote":"For Anthropic API users, we automatically delete inputs and outputs on our backend within 30 days of receipt or generation","source":"https://privacy.anthropic.com/en/articles/7996866-how-long-do-you-store-my-organization-s-data","quote_verified":true},"dpa":"https://trust.anthropic.com/","hq_country":"US","eu_data_residency":"no","residency_notes":"Claude API is global by default; the only first-party residency option documented is US-only inference (inference_geo: \"us\", 1.1x price).","residency_source":"https://docs.anthropic.com/en/docs/about-claude/pricing","prices":"https://prices.branolabs.com/providers/anthropic","last_checked":"2026-10-29"},{"slug":"baseten","name":"Baseten","page":"https://compliance.branolabs.com/p/baseten","trust_center":"https://trust.baseten.co/","certifications":[{"name":"SOC 2 Type 2","source":"https://trust.baseten.co/","scope":"product","note":null},{"name":"SOC 3","source":"https://trust.baseten.co/","scope":"product","note":null},{"name":"ISO/IEC 27001:2022","source":"https://trust.baseten.co/","scope":"product","note":null},{"name":"PCI DSS SAQ D","source":"https://trust.baseten.co/","scope":"product","note":null},{"name":"GDPR","source":"https://trust.baseten.co/","scope":"product","note":"Listed under compliance; GDPR is a law, not a certificate"},{"name":"FedRAMP 20x","source":"https://trust.baseten.co/","scope":"other","note":"A FedRAMP 20x package is listed; we could not confirm an authorization."}],"hipaa":{"status":"listed","quote":"HIPAA","source":"https://trust.baseten.co/","note":"Listed as a compliance framework in the trust center.","quote_verified":true},"training_on_api_data":null,"zero_data_retention":{"status":"available","quote":"Serve models with zero retention of inference inputs and outputs","source":"https://www.baseten.co/security/","quote_verified":true},"retention":null,"dpa":"https://trust.baseten.co/","hq_country":"US","eu_data_residency":null,"residency_notes":"Model API regions not stated on the pricing page. Enterprise plan advertises 'full control over data residency' and custom global regions (dedicated/self-hosted deployments).","residency_source":"https://www.baseten.co/pricing/","prices":"https://prices.branolabs.com/providers/baseten","last_checked":"2026-10-29"},{"slug":"berget-ai","name":"Berget AI","page":"https://compliance.branolabs.com/p/berget-ai","trust_center":"https://berget.ai/","certifications":[],"hipaa":null,"training_on_api_data":{"status":"no","quote":"never trains on your data","source":"https://berget.ai/","quote_verified":true},"zero_data_retention":{"status":"default","quote":"Berget AI never stores the content of your prompts or generated output","source":"https://berget.ai/","quote_verified":true},"retention":null,"dpa":"https://berget.ai/","hq_country":"Sweden","eu_data_residency":"yes","residency_notes":"Open models on Berget's own hardware in Sweden, under Swedish jurisdiction, zero data retention ('Your data stays in Europe'). Prices published in EUR via the public models API.","residency_source":"https://berget.ai/","prices":"https://prices.branolabs.com/providers/berget-ai","last_checked":"2026-10-29"},{"slug":"cerebras","name":"Cerebras Inference","page":"https://compliance.branolabs.com/p/cerebras","trust_center":"https://trust.cerebras.ai/","certifications":[{"name":"SOC 2","source":"https://trust.cerebras.ai/","scope":"product","note":null},{"name":"GDPR","source":"https://trust.cerebras.ai/","scope":"product","note":"Listed under compliance; GDPR is a law, not a certificate"},{"name":"CCPA","source":"https://trust.cerebras.ai/","scope":"product","note":"Listed under compliance; CCPA is a law, not a certificate"}],"hipaa":null,"training_on_api_data":null,"zero_data_retention":null,"retention":null,"dpa":"https://trust.cerebras.ai/","hq_country":"US","eu_data_residency":null,"residency_notes":"Pricing page and model docs do not say which data centers serve the self-serve API. OpenRouter's provider list reports HQ US, no datacenter countries.","residency_source":"https://www.cerebras.ai/pricing","prices":"https://prices.branolabs.com/providers/cerebras","last_checked":"2026-10-29"},{"slug":"cloudflare-workers-ai","name":"Cloudflare Workers AI","page":"https://compliance.branolabs.com/p/cloudflare-workers-ai","trust_center":"https://www.cloudflare.com/trust-hub/compliance-resources/","certifications":[{"name":"SOC 2 Type II","source":"https://www.cloudflare.com/trust-hub/compliance-resources/","scope":"company","note":null},{"name":"ISO 27001:2022","source":"https://www.cloudflare.com/trust-hub/compliance-resources/","scope":"company","note":null},{"name":"ISO 27701:2019","source":"https://www.cloudflare.com/trust-hub/compliance-resources/","scope":"company","note":null},{"name":"ISO 27018:2019","source":"https://www.cloudflare.com/trust-hub/compliance-resources/","scope":"company","note":null},{"name":"ISO 27017:2015","source":"https://www.cloudflare.com/trust-hub/compliance-resources/","scope":"company","note":null},{"name":"FedRAMP High","source":"https://www.cloudflare.com/trust-hub/compliance-resources/","scope":"company","note":null},{"name":"C5:2020","source":"https://www.cloudflare.com/trust-hub/compliance-resources/","scope":"company","note":null},{"name":"PCI DSS 4.0","source":"https://www.cloudflare.com/trust-hub/compliance-resources/","scope":"company","note":null},{"name":"CSA STAR","source":"https://www.cloudflare.com/trust-hub/compliance-resources/","scope":"company","note":null},{"name":"EU Cloud Code of Conduct","source":"https://www.cloudflare.com/trust-hub/compliance-resources/","scope":"company","note":null}],"hipaa":{"status":"request","quote":"Contact your account team to request the HIPAA AoC.","source":"https://www.cloudflare.com/trust-hub/compliance-resources/","quote_verified":true},"training_on_api_data":{"status":"no","quote":"such Customer Content is not used to train AI models or improve Cloudflare or third-party products or services","source":"https://developers.cloudflare.com/workers-ai/platform/privacy/","quote_verified":true},"zero_data_retention":{"status":"default","quote":"Workers AI processes Customer Content only for as long as needed to provide the service.","source":"https://developers.cloudflare.com/workers-ai/platform/privacy/","quote_verified":true},"retention":null,"dpa":null,"hq_country":"US","eu_data_residency":null,"residency_notes":"Runs on serverless GPUs across Cloudflare's global network; no EU-only processing option stated in the Workers AI docs. Prices are per-model unit prices billed in Neurons ($0.011 per 1,000 Neurons; 10,000 free Neurons/day).","residency_source":"https://developers.cloudflare.com/workers-ai/","prices":"https://prices.branolabs.com/providers/cloudflare-workers-ai","last_checked":"2026-10-29"},{"slug":"coreweave","name":"CoreWeave","page":"https://compliance.branolabs.com/p/coreweave","trust_center":"https://trust.coreweave.com/","certifications":[{"name":"SOC 2 Type II","source":"https://trust.coreweave.com/","scope":"product","note":null},{"name":"ISO/IEC 27001","source":"https://trust.coreweave.com/","scope":"product","note":null},{"name":"ISO/IEC 27017","source":"https://trust.coreweave.com/","scope":"product","note":null},{"name":"ISO/IEC 27018","source":"https://trust.coreweave.com/","scope":"product","note":null}],"hipaa":null,"training_on_api_data":null,"zero_data_retention":null,"retention":null,"dpa":null,"hq_country":"US","eu_data_residency":null,"residency_notes":"The Serverless Inference page lists per-model prices but does not state serving regions. OpenRouter's provider list reports CoreWeave's datacenters as US.","residency_source":null,"prices":"https://prices.branolabs.com/providers/coreweave","last_checked":"2026-10-29"},{"slug":"deepinfra","name":"DeepInfra","page":"https://compliance.branolabs.com/p/deepinfra","trust_center":"https://trust.deepinfra.com/","certifications":[{"name":"SOC 2","source":"https://trust.deepinfra.com/","scope":"product","note":null},{"name":"ISO/IEC 27001","source":"https://trust.deepinfra.com/","scope":"product","note":null}],"hipaa":{"status":"listed","quote":"HIPAA Compliant","source":"https://trust.deepinfra.com/","note":"Listed in the trust center; GDPR is listed as in progress.","quote_verified":true},"training_on_api_data":{"status":"no","quote":"We do not use data you submit to our APIs for training models, except when using Google or Anthropic models, where the receiving company’s training policy applies.","source":"https://deepinfra.com/docs/data","quote_verified":true},"zero_data_retention":{"status":"default","quote":"the data is deleted from disk and memory after a short retention period","source":"https://deepinfra.com/docs/data","quote_verified":true},"retention":null,"dpa":"https://trust.deepinfra.com/","hq_country":"US","eu_data_residency":null,"residency_notes":"Not stated on the pricing page.","residency_source":null,"prices":"https://prices.branolabs.com/providers/deepinfra","last_checked":"2026-10-29"},{"slug":"deepseek","name":"DeepSeek API","page":"https://compliance.branolabs.com/p/deepseek","trust_center":null,"certifications":[],"hipaa":null,"training_on_api_data":{"status":"unclear","quote":"the right to opt-out of using your Personal Data for training our models","source":"https://cdn.deepseek.com/policies/en-US/deepseek-privacy-policy.html","note":"The privacy policy mentions training and an opt-out right; it does not separate API customer data.","quote_verified":true},"zero_data_retention":null,"retention":null,"dpa":null,"hq_country":"China","eu_data_residency":null,"residency_notes":"Not stated on the pricing page.","residency_source":null,"prices":"https://prices.branolabs.com/providers/deepseek","last_checked":"2026-10-29"},{"slug":"fireworks","name":"Fireworks AI","page":"https://compliance.branolabs.com/p/fireworks","trust_center":"https://trust.fireworks.ai/","certifications":[{"name":"SOC 2 Type 2","source":"https://trust.fireworks.ai/","scope":"product","note":null},{"name":"ISO/IEC 27001:2022","source":"https://trust.fireworks.ai/","scope":"product","note":null},{"name":"ISO/IEC 27701","source":"https://trust.fireworks.ai/","scope":"product","note":null},{"name":"ISO/IEC 42001:2023","source":"https://trust.fireworks.ai/","scope":"product","note":null},{"name":"GDPR","source":"https://trust.fireworks.ai/","scope":"product","note":"Listed under compliance; GDPR is a law, not a certificate"}],"hipaa":{"status":"listed","quote":"HIPAA","source":"https://trust.fireworks.ai/","note":"Listed as a compliance framework in the trust center.","quote_verified":true},"training_on_api_data":null,"zero_data_retention":{"status":"default","quote":"Fireworks has Zero Data Retention by default.","source":"https://docs.fireworks.ai/guides/security_compliance/data_handling","note":"For open models; the Response API keeps data up to 30 days when store=True.","quote_verified":true},"retention":null,"dpa":"https://trust.fireworks.ai/","hq_country":"US","eu_data_residency":null,"residency_notes":"Some models have separately priced '(US)' variants (1.5x); default serving region not stated.","residency_source":"https://docs.fireworks.ai/serverless/pricing","prices":"https://prices.branolabs.com/providers/fireworks","last_checked":"2026-10-29"},{"slug":"google","name":"Google Gemini API (AI Studio)","page":"https://compliance.branolabs.com/p/google","trust_center":null,"certifications":[],"hipaa":null,"training_on_api_data":{"status":"paid_only","quote":"When you use Paid Services, including, for example, the paid quota of the Gemini API, Google doesn't use your prompts","source":"https://ai.google.dev/gemini-api/terms","note":"On the free tier (Google AI Studio and the unpaid quota) Google uses prompts and responses to improve its products.","quote_verified":true},"zero_data_retention":{"status":"not_guaranteed","quote":"If your workload requires guaranteed zero data retention or enterprise data processing agreements, use Vertex AI.","source":"https://ai.google.dev/gemini-api/docs/zdr","quote_verified":true},"retention":{"text":"Paid tier: logged for a limited period for abuse detection","quote":"For Paid Services, Google logs prompts and responses for a limited period of time, solely for detecting and preventing viol","source":"https://ai.google.dev/gemini-api/terms","quote_verified":true},"dpa":"https://ai.google.dev/gemini-api/terms","hq_country":"US","eu_data_residency":null,"residency_notes":"Gemini Developer API pricing page does not state processing regions. See Google Vertex AI for regional endpoints.","residency_source":null,"prices":"https://prices.branolabs.com/providers/google","last_checked":"2026-10-29"},{"slug":"google-vertex-ai","name":"Google Vertex AI (Gemini Enterprise Agent Platform)","page":"https://compliance.branolabs.com/p/google-vertex-ai","trust_center":"https://cloud.google.com/compliance","certifications":[{"name":"FedRAMP High","source":"https://cloud.google.com/blog/topics/public-sector/vertex-ai-search-and-generative-ai-with-gemini-achieve-fedramp-high","scope":"product","note":null},{"name":"ISO/IEC 27001","source":"https://cloud.google.com/compliance","scope":"company","note":null},{"name":"ISO/IEC 27017","source":"https://cloud.google.com/compliance","scope":"company","note":null},{"name":"ISO/IEC 27018","source":"https://cloud.google.com/compliance","scope":"company","note":null},{"name":"ISO/IEC 27701","source":"https://cloud.google.com/compliance","scope":"company","note":null},{"name":"ISO/IEC 42001","source":"https://cloud.google.com/compliance","scope":"company","note":null},{"name":"SOC 2","source":"https://cloud.google.com/compliance","scope":"company","note":null},{"name":"C5","source":"https://cloud.google.com/compliance","scope":"company","note":null}],"hipaa":null,"training_on_api_data":{"status":"no","quote":"Google won't use your data to train or fine-tune any AI/ML models without your prior permission or instruction.","source":"https://cloud.google.com/vertex-ai/generative-ai/docs/data-governance","quote_verified":true},"zero_data_retention":{"status":"configurable","quote":"To achieve zero data retention, customers must take specific a","source":"https://cloud.google.com/vertex-ai/generative-ai/docs/data-governance","note":"Zero retention needs specific settings (for example turning off caching and abuse logging exceptions); see the page.","quote_verified":true},"retention":null,"dpa":"https://cloud.google.com/vertex-ai/generative-ai/docs/data-governance","hq_country":"US","eu_data_residency":null,"residency_notes":"Global and non-global (regional) endpoints are offered (~10% uplift for regional); which EU regions host which model is not listed on the pricing page.","residency_source":"https://cloud.google.com/vertex-ai/generative-ai/pricing","prices":"https://prices.branolabs.com/providers/google-vertex-ai","last_checked":"2026-10-29"},{"slug":"groq","name":"Groq","page":"https://compliance.branolabs.com/p/groq","trust_center":"https://trust.groq.com/","certifications":[{"name":"SOC 2 Type II","source":"https://trust.groq.com/","scope":"product","note":null},{"name":"GDPR","source":"https://trust.groq.com/","scope":"product","note":"Listed under compliance; GDPR is a law, not a certificate"}],"hipaa":{"status":"listed","quote":"HIPAA","source":"https://trust.groq.com/","note":"Listed as a compliance framework in the trust center.","quote_verified":true},"training_on_api_data":null,"zero_data_retention":{"status":"self_serve","quote":"All customers may enable Zero Data Retention (ZDR) in Data Controls settings","source":"https://console.groq.com/docs/your-data","quote_verified":true},"retention":{"text":"Reliability and abuse logs up to 30 days","quote":"These logs are retained for up to 30 days","source":"https://console.groq.com/docs/your-data","quote_verified":true},"dpa":null,"hq_country":"US","eu_data_residency":null,"residency_notes":"Not stated on the models page.","residency_source":null,"prices":"https://prices.branolabs.com/providers/groq","last_checked":"2026-10-29"},{"slug":"infomaniak-ai-services","name":"Infomaniak AI Services","page":"https://compliance.branolabs.com/p/infomaniak-ai-services","trust_center":null,"certifications":[],"hipaa":null,"training_on_api_data":{"status":"no","quote":"Your queries are neither recorded nor used to train models or improve our services.","source":"https://www.infomaniak.com/en/hosting/ai-services","quote_verified":true},"zero_data_retention":{"status":"default","quote":"Your queries are neither recorded nor used to train models or improve our services.","source":"https://www.infomaniak.com/en/hosting/ai-services","quote_verified":true},"retention":null,"dpa":null,"hq_country":"Switzerland","eu_data_residency":null,"residency_notes":"AI Services page says 'hosted in Europe' without naming the country. The Euria assistant page says it is 'Hosted exclusively in Switzerland'. Switzerland is not in the EU. Euria itself is a free chat assistant; its API offering is Infomaniak AI Services.","residency_source":"https://www.infomaniak.com/en/hosting/ai-services","prices":"https://prices.branolabs.com/providers/infomaniak-ai-services","last_checked":"2026-10-29"},{"slug":"mistral","name":"Mistral AI (La Plateforme / Studio)","page":"https://compliance.branolabs.com/p/mistral","trust_center":"https://trust.mistral.ai/","certifications":[{"name":"ISO/IEC 27001","source":"https://trust.mistral.ai/","scope":"product","note":null},{"name":"ISO/IEC 27701","source":"https://trust.mistral.ai/","scope":"product","note":null},{"name":"SOC 2 Type II","source":"https://trust.mistral.ai/","scope":"product","note":null}],"hipaa":{"status":"listed","quote":"HIPAA Compliance with Mistral AI","source":"https://trust.mistral.ai/","note":"A HIPAA document is listed in the trust center; details are behind its access request.","quote_verified":true},"training_on_api_data":{"status":"opt_out","quote":"Customers retain full control over this processing and have the right to opt out at any time.","source":"https://help.mistral.ai/en/articles/347617-do-you-use-my-user-data-to-train-your-artificial-intelligence-models","note":"Pay-as-you-go: inputs and outputs may be used for training unless you opt out.","quote_verified":true},"zero_data_retention":{"status":"on_request","quote":"We will review your request and, at our discretion, approve or deny it.","source":"https://help.mistral.ai/en/articles/347612-can-i-activate-zero-data-retention-zdr","quote_verified":true},"retention":null,"dpa":"https://trust.mistral.ai/","hq_country":"France","eu_data_residency":"partial","residency_notes":"Optional EU regional inference via api.eu.mistral.ai (+10% vs list). Control-plane data (account, keys, billing, analytics) may still be handled outside the selected inference region.","residency_source":"https://docs.mistral.ai/inference/regional-inference","prices":"https://prices.branolabs.com/providers/mistral","last_checked":"2026-10-29"},{"slug":"nebius-token-factory","name":"Nebius Token Factory","page":"https://compliance.branolabs.com/p/nebius-token-factory","trust_center":"https://nebius.com/trust-center","certifications":[{"name":"SOC 2 Type II","source":"https://nebius.com/trust-center","scope":"company","note":null},{"name":"ISO/IEC 27001","source":"https://nebius.com/trust-center","scope":"company","note":null},{"name":"ISO/IEC 27018","source":"https://nebius.com/trust-center","scope":"company","note":null},{"name":"ISO/IEC 27701","source":"https://nebius.com/trust-center","scope":"company","note":null},{"name":"ISO 22301","source":"https://nebius.com/trust-center","scope":"company","note":null},{"name":"ISO 27799","source":"https://nebius.com/trust-center","scope":"company","note":null}],"hipaa":{"status":"listed","quote":"SOC 2 Type II With HIPAA.","source":"https://nebius.com/trust-center","note":"The SOC 2 Type II report includes HIPAA.","quote_verified":true},"training_on_api_data":null,"zero_data_retention":null,"retention":null,"dpa":null,"hq_country":"Netherlands","eu_data_residency":"partial","residency_notes":"Public catalog lists regions including FI (eu-north1) and FR (eu-west2) plus US and UK. Per-model serving region varies; EU residency is not guaranteed for every model.","residency_source":"https://tokenfactory.nebius.com/api/public/models_info","prices":"https://prices.branolabs.com/providers/nebius-token-factory","last_checked":"2026-10-29"},{"slug":"openai","name":"OpenAI API","page":"https://compliance.branolabs.com/p/openai","trust_center":"https://openai.com/security-and-privacy/","certifications":[{"name":"SOC 2 Type 2","source":"https://openai.com/security-and-privacy/","scope":"product","note":null},{"name":"ISO/IEC 27001:2022","source":"https://openai.com/security-and-privacy/","scope":"product","note":null},{"name":"ISO/IEC 27017","source":"https://openai.com/security-and-privacy/","scope":"product","note":null},{"name":"ISO/IEC 27018","source":"https://openai.com/security-and-privacy/","scope":"product","note":null},{"name":"ISO/IEC 27701:2019","source":"https://openai.com/security-and-privacy/","scope":"product","note":null},{"name":"ISO/IEC 42001:2023","source":"https://openai.com/security-and-privacy/","scope":"product","note":null},{"name":"CSA STAR Level 1","source":"https://openai.com/security-and-privacy/","scope":"product","note":null}],"hipaa":{"status":"baa","quote":"offers a Data Processing Addendum and Business Associate Agreement for customers","source":"https://openai.com/security-and-privacy/","quote_verified":true},"training_on_api_data":{"status":"no","quote":"As of March 1, 2023, data sent to the OpenAI API is not used to train or improve OpenAI models (unless you explicitly opt in to share data with us).","source":"https://platform.openai.com/docs/guides/your-data","quote_verified":true},"zero_data_retention":{"status":"on_request","quote":"Currently, these controls are subject to prior approval by OpenAI and acceptance of additional requirements.","source":"https://platform.openai.com/docs/guides/your-data","quote_verified":true},"retention":{"text":"Abuse monitoring logs up to 30 days","quote":"abuse monitoring logs are generated for all API feature usage and retained for up to 30 days","source":"https://platform.openai.com/docs/guides/your-data","quote_verified":true},"dpa":"https://openai.com/security-and-privacy/","hq_country":"US","eu_data_residency":"yes","residency_notes":"EU (EEA+CH) regional storage and processing via eu.api.openai.com; requires approval and ZDR/Modified Abuse Monitoring; +10% for models released on/after 2026-03-05.","residency_source":"https://platform.openai.com/docs/guides/your-data","prices":"https://prices.branolabs.com/providers/openai","last_checked":"2026-10-29"},{"slug":"openrouter","name":"OpenRouter (router)","page":"https://compliance.branolabs.com/p/openrouter","trust_center":null,"certifications":[],"hipaa":null,"training_on_api_data":{"status":"per_provider","quote":"you can set whether you would like to allow routing to providers that may train on your data","source":"https://openrouter.ai/docs/features/privacy-and-logging","quote_verified":true},"zero_data_retention":{"status":"routing","quote":"You can enforce ZDR globally, per model group, per guardrail, or per request.","source":"https://openrouter.ai/docs/features/zdr","note":"OpenRouter routes only to providers that declare zero retention when you turn this on.","quote_verified":true},"retention":null,"dpa":null,"hq_country":"US","eu_data_residency":null,"residency_notes":"Routes to upstream providers; location depends on the upstream provider.","residency_source":null,"prices":"https://prices.branolabs.com/providers/openrouter","last_checked":"2026-10-29"},{"slug":"sambanova","name":"SambaNova Cloud","page":"https://compliance.branolabs.com/p/sambanova","trust_center":"https://trust.sambanova.ai/","certifications":[{"name":"SOC 2 Type 2","source":"https://trust.sambanova.ai/","scope":"product","note":null},{"name":"ISO/IEC 27001:2022","source":"https://trust.sambanova.ai/","scope":"product","note":null}],"hipaa":null,"training_on_api_data":null,"zero_data_retention":null,"retention":null,"dpa":null,"hq_country":"US","eu_data_residency":null,"residency_notes":"No public EU data-residency commitment found on the SambaNova Cloud pricing/plans pages.","residency_source":"https://cloud.sambanova.ai/plans/pricing","prices":"https://prices.branolabs.com/providers/sambanova","last_checked":"2026-10-29"},{"slug":"together-ai","name":"Together AI","page":"https://compliance.branolabs.com/p/together-ai","trust_center":"https://trust.together.ai/","certifications":[{"name":"SOC 2 Type 2","source":"https://trust.together.ai/","scope":"product","note":null},{"name":"ISO/IEC 27001:2022","source":"https://trust.together.ai/","scope":"product","note":null}],"hipaa":null,"training_on_api_data":{"status":"no","quote":"Use of your data for training models is a separate opt-in and is off by default.","source":"https://docs.together.ai/docs/zero-data-retention","quote_verified":true},"zero_data_retention":{"status":"self_serve","quote":"Organization admins can turn storage off in privacy settings, which enables zero data retention (ZDR)","source":"https://docs.together.ai/docs/privacy-and-security","note":"Prompt and response storage is on by default.","quote_verified":true},"retention":{"text":"Prompts and responses stored by default until you turn it off","quote":"Stores prompts and outputs for product improvements.","source":"https://docs.together.ai/docs/privacy-and-security","quote_verified":true},"dpa":"https://trust.together.ai/","hq_country":"US","eu_data_residency":null,"residency_notes":"Not stated on the pricing page.","residency_source":null,"prices":"https://prices.branolabs.com/providers/together-ai","last_checked":"2026-10-29"},{"slug":"xai","name":"xAI (Grok API)","page":"https://compliance.branolabs.com/p/xai","trust_center":"https://docs.x.ai/developers/faq/security","certifications":[{"name":"SOC 2 Type 2","source":"https://docs.x.ai/developers/faq/security","scope":"product","note":null}],"hipaa":{"status":"request","quote":"To inquire about a Business Associate Agreement (BAA), please complete our BAA Questionnaire.","source":"https://docs.x.ai/developers/faq/security","quote_verified":true},"training_on_api_data":{"status":"no","quote":"never trains on your API inputs or outputs without your explicit permission","source":"https://docs.x.ai/developers/faq/security","quote_verified":true},"zero_data_retention":{"status":"self_serve","quote":"a team admin can turn it on or off directly from the xAI Console","source":"https://docs.x.ai/developers/faq/security","quote_verified":true},"retention":{"text":"30 days for abuse audits","quote":"it is automatically deleted after 30 days.","source":"https://docs.x.ai/developers/faq/security","quote_verified":true},"dpa":null,"hq_country":"US","eu_data_residency":null,"residency_notes":"Not stated on the models/pricing page.","residency_source":null,"prices":"https://prices.branolabs.com/providers/xai","last_checked":"2026-10-29"}]}