# LLM API Compliance Finder

> Which LLM API providers publish SOC 2, ISO 27001/27701/42001, FedRAMP or C5, offer a HIPAA BAA, zero data retention and EU data residency, and whether they train on API data. 21 providers, each claim with its source URL and a verbatim quote from the provider's own page, checked 2026-10-29. Documented claims only, not an audit or legal advice. "not published" means we found nothing on the pages we checked.

Machine-readable data: https://compliance.branolabs.com/api/providers.json
Per-provider pages: https://compliance.branolabs.com/p/<slug>

## Providers
- Amazon Bedrock (HQ United States): certifications ISO, SOC, CSA STAR Level 2, FedRAMP High; HIPAA BAA / HIPAA eligible; zero data retention not published; training on API data Not used for training by default; EU data residency Partial. https://compliance.branolabs.com/p/amazon-bedrock
- Anthropic (Claude API) (HQ United States): certifications SOC 2 Type 2, ISO/IEC 27001:2022, ISO/IEC 42001:2023, CSA STAR, NIST 800-171; HIPAA BAA / HIPAA eligible; zero data retention On request / approval; training on API data Not used for training by default; EU data residency No. https://compliance.branolabs.com/p/anthropic
- Baseten (HQ United States): certifications SOC 2 Type 2, SOC 3, ISO/IEC 27001:2022, PCI DSS SAQ D, GDPR; HIPAA Listed in trust center; zero data retention Offered; training on API data not published; EU data residency unknown. https://compliance.branolabs.com/p/baseten
- Berget AI (HQ Sweden): certifications not published; HIPAA not published; zero data retention Zero retention by default; training on API data Not used for training by default; EU data residency Yes. https://compliance.branolabs.com/p/berget-ai
- Cerebras Inference (HQ United States): certifications SOC 2, GDPR, CCPA; HIPAA not published; zero data retention not published; training on API data not published; EU data residency unknown. https://compliance.branolabs.com/p/cerebras
- Cloudflare Workers AI (HQ United States): certifications SOC 2 Type II (company-wide), ISO 27001:2022 (company-wide), ISO 27701:2019 (company-wide), ISO 27018:2019 (company-wide), ISO 27017:2015 (company-wide), FedRAMP High (company-wide), C5:2020 (company-wide), PCI DSS 4.0 (company-wide), CSA STAR (company-wide), EU Cloud Code of Conduct (company-wide); HIPAA BAA on request; zero data retention Zero retention by default; training on API data Not used for training by default; EU data residency unknown. https://compliance.branolabs.com/p/cloudflare-workers-ai
- CoreWeave (HQ United States): certifications SOC 2 Type II, ISO/IEC 27001, ISO/IEC 27017, ISO/IEC 27018; HIPAA not published; zero data retention not published; training on API data not published; EU data residency unknown. https://compliance.branolabs.com/p/coreweave
- DeepInfra (HQ United States): certifications SOC 2, ISO/IEC 27001; HIPAA Listed in trust center; zero data retention Zero retention by default; training on API data Not used for training by default; EU data residency unknown. https://compliance.branolabs.com/p/deepinfra
- DeepSeek API (HQ China): certifications not published; HIPAA not published; zero data retention not published; training on API data Unclear for API data; EU data residency unknown. https://compliance.branolabs.com/p/deepseek
- Fireworks AI (HQ United States): certifications SOC 2 Type 2, ISO/IEC 27001:2022, ISO/IEC 27701, ISO/IEC 42001:2023, GDPR; HIPAA Listed in trust center; zero data retention Zero retention by default; training on API data not published; EU data residency unknown. https://compliance.branolabs.com/p/fireworks
- Google Gemini API (AI Studio) (HQ United States): certifications not published; HIPAA not published; zero data retention Not guaranteed; training on API data Not used on paid tier only; EU data residency unknown. https://compliance.branolabs.com/p/google
- Google Vertex AI (Gemini Enterprise Agent Platform) (HQ United States): certifications FedRAMP High, ISO/IEC 27001 (company-wide), ISO/IEC 27017 (company-wide), ISO/IEC 27018 (company-wide), ISO/IEC 27701 (company-wide), ISO/IEC 42001 (company-wide), SOC 2 (company-wide), C5 (company-wide); HIPAA not published; zero data retention Configurable; training on API data Not used for training by default; EU data residency unknown. https://compliance.branolabs.com/p/google-vertex-ai
- Groq (HQ United States): certifications SOC 2 Type II, GDPR; HIPAA Listed in trust center; zero data retention Self-serve setting; training on API data not published; EU data residency unknown. https://compliance.branolabs.com/p/groq
- Infomaniak AI Services (HQ Switzerland): certifications not published; HIPAA not published; zero data retention Zero retention by default; training on API data Not used for training by default; EU data residency unknown. https://compliance.branolabs.com/p/infomaniak-ai-services
- Mistral AI (La Plateforme / Studio) (HQ France): certifications ISO/IEC 27001, ISO/IEC 27701, SOC 2 Type II; HIPAA Listed in trust center; zero data retention On request / approval; training on API data Used unless you opt out; EU data residency Partial. https://compliance.branolabs.com/p/mistral
- Nebius Token Factory (HQ Netherlands): certifications SOC 2 Type II (company-wide), ISO/IEC 27001 (company-wide), ISO/IEC 27018 (company-wide), ISO/IEC 27701 (company-wide), ISO 22301 (company-wide), ISO 27799 (company-wide); HIPAA Listed in trust center; zero data retention not published; training on API data not published; EU data residency Partial. https://compliance.branolabs.com/p/nebius-token-factory
- OpenAI API (HQ United States): certifications SOC 2 Type 2, ISO/IEC 27001:2022, ISO/IEC 27017, ISO/IEC 27018, ISO/IEC 27701:2019, ISO/IEC 42001:2023, CSA STAR Level 1; HIPAA BAA / HIPAA eligible; zero data retention On request / approval; training on API data Not used for training by default; EU data residency Yes. https://compliance.branolabs.com/p/openai
- OpenRouter (router) (HQ United States): certifications not published; HIPAA not published; zero data retention Routing filter; training on API data Depends on the routed provider; EU data residency unknown. https://compliance.branolabs.com/p/openrouter
- SambaNova Cloud (HQ United States): certifications SOC 2 Type 2, ISO/IEC 27001:2022; HIPAA not published; zero data retention not published; training on API data not published; EU data residency unknown. https://compliance.branolabs.com/p/sambanova
- Together AI (HQ United States): certifications SOC 2 Type 2, ISO/IEC 27001:2022; HIPAA not published; zero data retention Self-serve setting; training on API data Not used for training by default; EU data residency unknown. https://compliance.branolabs.com/p/together-ai
- xAI (Grok API) (HQ United States): certifications SOC 2 Type 2; HIPAA BAA on request; zero data retention Self-serve setting; training on API data Not used for training by default; EU data residency unknown. https://compliance.branolabs.com/p/xai

## Pages
- [Methodology](https://compliance.branolabs.com/about)

## Optional
- [LLM API price tracker](https://prices.branolabs.com): per-token prices for the same providers
- [@BranoLabs on X](https://x.com/BranoLabs)
- [BranoLabs](https://branolabs.com): more small, data-backed AI tools