{
 "generated": "2026-10-21",
 "field_labels": {
  "trains_by_default": "Trains on your data by default",
  "retention": "Default retention",
  "zdr": "Zero data retention",
  "abuse_monitoring": "Abuse-monitoring exception",
  "residency": "Data residency / regions",
  "certifications": "SOC 2 / ISO 27001",
  "hipaa_baa": "HIPAA BAA",
  "self_host": "Self-host option"
 },
 "vendors": [
  {
   "slug": "openai-api",
   "name": "OpenAI API",
   "category": "Model APIs",
   "vendor": "OpenAI",
   "region_filter": "sg",
   "notes": "",
   "fields": {
    "trains_by_default": {
     "value": "no",
     "detail": "Not used for training unless you opt in (e.g. via feedback sharing).",
     "quote": "As of March 1, 2023, data sent to the OpenAI API is not used to train or improve OpenAI models (unless you explicitly opt in to share data with us).",
     "source": "https://platform.openai.com/docs/guides/your-data",
     "checked": "2026-10-21"
    },
    "retention": {
     "value": "30 days",
     "detail": "Abuse monitoring logs up to 30 days. Stateful endpoints (Assistants, Conversations, vector stores, files) keep application state until you delete it.",
     "quote": "By default, abuse monitoring logs are generated for all API feature usage and retained for up to 30 days, unless longer retention is required by law, or is reasonably necessary to protect our services or any third party from harm.",
     "source": "https://platform.openai.com/docs/guides/your-data",
     "checked": "2026-10-21"
    },
    "zdr": {
     "value": "on approval",
     "detail": "Zero Data Retention or Modified Abuse Monitoring, per org or project, after OpenAI approves you. Stateful endpoints are not ZDR-eligible.",
     "quote": "Currently, these controls are subject to prior approval by OpenAI and acceptance of additional requirements.",
     "source": "https://platform.openai.com/docs/guides/your-data",
     "checked": "2026-10-21"
    },
    "abuse_monitoring": {
     "value": "can override ZDR",
     "detail": "Even after approval, OpenAI can switch specific models back to retention ('Safety Retention') for severe-risk investigations, with advance written notice.",
     "quote": "we reserve the right to make models ineligible for Zero Data Retention or Modified Abuse Monitoring for specific customers if reasonably necessary to investigate or prevent severe risk activity",
     "source": "https://platform.openai.com/docs/guides/your-data",
     "checked": "2026-10-21"
    },
    "residency": {
     "value": "US, EU, AU, CA, JP, IN, SG, KR, UK, UAE",
     "detail": "Per-project regions. Singapore (sg.api.openai.com) and the United Kingdom (gb.api.openai.com) give regional storage only, not regional processing; the same is true for AU, CA, JP, IN and KR. Regional processing is listed only for the US, EU and UAE. Non-US regions require MAM or ZDR approval and a Modified Retention amendment.",
     "quote": "To use data residency with any region other than the United States, you must be approved for abuse monitoring controls, and execute a Modified Retention amendment. … United Kingdom* | gb.api.openai.com | Yes | No | Yes",
     "source": "https://platform.openai.com/docs/guides/your-data",
     "checked": "2026-10-25"
    },
    "certifications": {
     "value": "SOC 2 Type 2",
     "detail": "SOC 2 Type 2 for the API Platform. ISO 27001 not confirmed on the pages checked.",
     "quote": "Our API Platform has been audited and certified for SOC 2 Type 2 compliance.",
     "source": "https://openai.com/enterprise-privacy/",
     "checked": "2026-10-21"
    },
    "hipaa_baa": {
     "value": "yes",
     "detail": "BAA available on request; only BAA-eligible endpoints may process PHI.",
     "quote": "We are able to sign Business Associate Agreements (BAA) in support of customers’ compliance with the Health Insurance Portability and Accountability Act (HIPAA).",
     "source": "https://openai.com/enterprise-privacy/",
     "checked": "2026-10-21"
    },
    "self_host": {
     "value": "partial (open-weight gpt-oss only)",
     "detail": "API models are hosted only. OpenAI separately publishes open-weight gpt-oss models (120B and 20B, Apache 2.0) that you can run yourself.",
     "quote": "Open reasoning models designed to run locally on desktops, laptops, and in data centers—available in 120B and 20B parameters.",
     "source": "https://openai.com/open-models/",
     "checked": "2026-10-21"
    }
   }
  },
  {
   "slug": "anthropic-api",
   "name": "Anthropic API (Claude)",
   "category": "Model APIs",
   "vendor": "Anthropic",
   "region_filter": "none",
   "notes": "",
   "fields": {
    "trains_by_default": {
     "value": "no",
     "detail": "Commercial products (API, Claude for Work) are not trained on unless you send feedback or opt in.",
     "quote": "By default, we will not use your inputs or outputs from our commercial products (e.g. Claude for Work, Anthropic API, Claude Gov, etc.) to train our models.",
     "source": "https://privacy.anthropic.com/en/articles/7996868-is-my-data-used-for-model-training",
     "checked": "2026-10-21"
    },
    "retention": {
     "value": "30 days",
     "detail": "Deleted within 30 days, except Files API and similar features you control, ZDR agreements, Usage Policy enforcement, or legal requirements.",
     "quote": "For Anthropic API users, we automatically delete inputs and outputs on our backend within 30 days of receipt or generation",
     "source": "https://privacy.anthropic.com/en/articles/7996866-how-long-do-you-store-my-organization-s-data",
     "checked": "2026-10-21"
    },
    "zdr": {
     "value": "on request",
     "detail": "Enabled per organization by the account team. 'Covered Models' (Claude Fable 5/5.1, Mythos 5/5.1) require 30-day retention and are not available under ZDR unless Anthropic authorizes it.",
     "quote": "Under a ZDR arrangement, Anthropic does not store customer prompts or responses at rest after the API response is returned.",
     "source": "https://docs.anthropic.com/en/docs/build-with-claude/zero-data-retention",
     "checked": "2026-10-21"
    },
    "abuse_monitoring": {
     "value": "2 years if flagged",
     "detail": "Flagged content is kept far longer than the 30-day default.",
     "quote": "We retain inputs and outputs for up to 2 years and trust and safety classification scores for up to 7 years if your chat is flagged by our automated trust and safety systems as violating our",
     "source": "https://privacy.anthropic.com/en/articles/7996866-how-long-do-you-store-my-organization-s-data",
     "checked": "2026-10-21"
    },
    "residency": {
     "value": "US or global",
     "detail": "inference_geo per request is 'global' (default) or 'us'. Workspace (storage) geo: 'us' is the only option. No APAC option documented.",
     "quote": "Default. Inference may run in any available geography for optimal performance and availability.",
     "source": "https://docs.anthropic.com/en/docs/build-with-claude/data-residency",
     "checked": "2026-10-21"
    },
    "certifications": {
     "value": "SOC 2 Type I & II; ISO 27001; ISO 42001",
     "detail": "",
     "quote": "ISO 27001:2022 (Information Security Management) ISO/IEC 42001:2023 (AI Management Systems) SOC 2 Type I & Type II",
     "source": "https://privacy.anthropic.com/en/articles/10015870-what-certifications-has-anthropic-obtained",
     "checked": "2026-10-21"
    },
    "hipaa_baa": {
     "value": "yes",
     "detail": "Self-serve: eligible orgs sign the BAA and enable HIPAA readiness in the Claude Console. HIPAA readiness is permanent once enabled.",
     "quote": "Eligible organizations can review and execute the BAA and enable HIPAA readiness directly from the Claude Console.",
     "source": "https://docs.anthropic.com/en/docs/build-with-claude/zero-data-retention",
     "checked": "2026-10-21"
    },
    "self_host": {
     "value": "no (hosted only)",
     "detail": "Claude models are listed only with IDs for the Claude API, Amazon Bedrock, Google Cloud and Microsoft Foundry. No downloadable weights or on-prem option appears in the docs.",
     "quote": "Each model's page lists the platforms it's available on.",
     "source": "https://platform.claude.com/docs/en/about-claude/models/overview",
     "checked": "2026-10-21"
    }
   }
  },
  {
   "slug": "gemini-api",
   "name": "Google Gemini API",
   "category": "Model APIs",
   "vendor": "Google",
   "region_filter": "none",
   "notes": "",
   "fields": {
    "trains_by_default": {
     "value": "depends",
     "detail": "Free tier / AI Studio ('Unpaid Services'): used to improve products, and human reviewers may read it. Paid (billing-enabled project): not used. In the EEA, Switzerland and UK, paid-tier terms apply to everything.",
     "quote": "When you use Unpaid Services, including, for example, Google AI Studio and the unpaid quota on Gemini API, Google uses the content you submit to the Services and any generated responses to provide, improve, and develop Google products",
     "source": "https://ai.google.dev/gemini-api/terms",
     "checked": "2026-10-21"
    },
    "retention": {
     "value": "'limited period' (not specified)",
     "detail": "Paid tier prompts are logged for abuse detection for an unspecified period. Grounding with Google Search/Maps stores data for 30 days with no way to disable it.",
     "quote": "For Paid Services, Google logs prompts and responses for a limited period of time, solely for detecting and preventing violations of the",
     "source": "https://ai.google.dev/gemini-api/terms",
     "checked": "2026-10-21"
    },
    "zdr": {
     "value": "no (use Vertex AI)",
     "detail": "Google points customers who need guaranteed ZDR to Vertex AI instead of the Gemini Developer API.",
     "quote": "If your workload requires guaranteed zero data retention or enterprise data processing agreements, use Vertex AI.",
     "source": "https://ai.google.dev/gemini-api/docs/zdr",
     "checked": "2026-10-21"
    },
    "abuse_monitoring": {
     "value": "always on (paid)",
     "detail": "Abuse logging applies to paid usage; free usage may also get human review.",
     "quote": "To help with quality and improve our products, human reviewers may read, annotate, and process your API input and output.",
     "source": "https://ai.google.dev/gemini-api/terms",
     "checked": "2026-10-21"
    },
    "residency": {
     "value": "none",
     "detail": "No region choice on the Gemini Developer API.",
     "quote": "This data may be stored transiently or cached in any country in which Google or its agents maintain facilities.",
     "source": "https://ai.google.dev/gemini-api/terms",
     "checked": "2026-10-21"
    },
    "certifications": {
     "value": "unverified",
     "detail": "No certification statement for the Gemini Developer API (AI Studio) on Google's policy pages. Google Cloud's ISO 27001 list covers Vertex AI / Gemini Enterprise Agent Platform, not this API. A Google forum reply (May 2025) says AI Studio is not ISO 27001 certified, but that is not a policy page.",
     "quote": "",
     "source": "https://ai.google.dev/gemini-api/terms",
     "checked": "2026-10-21"
    },
    "hipaa_baa": {
     "value": "no (PHI barred without Google's written consent)",
     "detail": "The Gemini API terms build on the Google APIs Terms, which bar HIPAA covered entities and business associates from sending PHI without Google's prior written consent. Google points regulated workloads to Vertex AI under the Google Cloud BAA; that is a separate product.",
     "quote": "you will not use the APIs for any purpose or in any manner involving transmitting protected health information to Google unless you have received prior written consent to such use from Google.",
     "source": "https://developers.google.com/terms",
     "checked": "2026-10-21"
    },
    "self_host": {
     "value": "separate product (Gemini on GDC)",
     "detail": "The Gemini API itself is hosted only. Google sells Gemini on Google Distributed Cloud air-gapped (GA, Aug 2025) for on-premises use, which is a separate enterprise product.",
     "quote": "We are announcing the general availability of Gemini on GDC air-gapped and preview of Gemini on GDC connected, bringing Google's most advanced models directly into your data center.",
     "source": "https://cloud.google.com/blog/topics/hybrid-cloud/gemini-is-now-available-anywhere",
     "checked": "2026-10-21"
    }
   }
  },
  {
   "slug": "mistral",
   "name": "Mistral AI (Studio / API)",
   "category": "Model APIs",
   "vendor": "Mistral AI",
   "region_filter": "none",
   "notes": "",
   "fields": {
    "trains_by_default": {
     "value": "depends",
     "detail": "Free mode: may train. Pay-as-you-go: you can opt out at any time. Vibe (chat): trains by default unless you opt out. Enterprise: opted out by default.",
     "quote": "As stated during subscription, we may use your data (input and output) to train our artificial intelligence models.",
     "source": "https://help.mistral.ai/en/articles/347617-do-you-use-my-user-data-to-train-your-artificial-intelligence-models",
     "checked": "2026-10-21"
    },
    "retention": {
     "value": "30 days (API, rolling)",
     "detail": "Standard API inputs and outputs are kept for 30 rolling days for abuse monitoring unless ZDR is on. The Agents API keeps data until account termination, and fine-tuning data until you delete it.",
     "quote": "Except for specific APIs, we keep your Input and Output for the period necessary to generate the Output and then for thirty (30) rolling days to monitor abuse (unless zero data retention is activated).",
     "source": "https://legal.mistral.ai/terms/privacy-policy/?lang=en",
     "checked": "2026-10-21"
    },
    "zdr": {
     "value": "on request (PAYG only)",
     "detail": "Pay-as-you-go only, stateless endpoints only, approved at Mistral's discretion. Files, batch, agents and conversations are out of scope.",
     "quote": "We will review your request and, at our discretion, approve or deny it.",
     "source": "https://help.mistral.ai/en/articles/347612-can-i-activate-zero-data-retention-zdr",
     "checked": "2026-10-21"
    },
    "abuse_monitoring": {
     "value": "yes, 30 days (off with ZDR)",
     "detail": "The DPA lists automated moderation and API abuse monitoring as processing purposes, except when ZDR is active.",
     "quote": "Automated moderation, including abuse monitoring on our APIs (except, in this last case, when zero data retention has been activated), to enforce the Agreement.",
     "source": "https://legal.mistral.ai/terms/data-processing-addendum/",
     "checked": "2026-10-21"
    },
    "residency": {
     "value": "EU (default) or US",
     "detail": "EU by default; US via a separate endpoint. Some features may transfer data outside the EU to listed subprocessors.",
     "quote": "By default, your data is hosted in the European Union.",
     "source": "https://help.mistral.ai/en/articles/347629-where-do-you-store-my-data-or-my-organization-s-data",
     "checked": "2026-10-21"
    },
    "certifications": {
     "value": "SOC 2 Type II; ISO 27001/27701",
     "detail": "Reports available on request via the Trust Center.",
     "quote": "Yes, Mistral complies with both SOC 2 Type II and ISO 27001/27701 frameworks.",
     "source": "https://help.mistral.ai/en/articles/347638-do-you-have-soc-2-or-iso-27001-certification",
     "checked": "2026-10-21"
    },
    "hipaa_baa": {
     "value": "unverified",
     "detail": "Not stated on Mistral's public pages read (help center, DPA, trust center front page, which lists ISO 27001, ISO 27701 and SOC 2 Type II only). Third-party sites say a BAA exists for some services, but this could not be confirmed on an official page.",
     "quote": "",
     "source": "https://help.mistral.ai/en/articles/347612-can-i-activate-zero-data-retention-zdr",
     "checked": "2026-10-21"
    },
    "self_host": {
     "value": "yes (open models)",
     "detail": "Mistral documents self-deploying its models with vLLM, TensorRT-LLM or TGI.",
     "quote": "Mistral AI models can be self-deployed on your own infrastructure through various inference engines.",
     "source": "https://docs.mistral.ai/deployment/self-deployment",
     "checked": "2026-10-21"
    }
   }
  },
  {
   "slug": "cohere",
   "name": "Cohere",
   "category": "Model APIs",
   "vendor": "Cohere",
   "region_filter": "none",
   "notes": "",
   "fields": {
    "trains_by_default": {
     "value": "depends",
     "detail": "Trial keys: Cohere may use your inputs and outputs for research and to improve its products (de-identified first). Paid (Enterprise) users have an opt-out toggle under Settings → Data Controls; the default for paid accounts is not stated.",
     "quote": "We may use this input and output data to conduct research and development. This includes analyzing usage trends and using inputs/outputs to improve the performance and safety of Cohere Products.",
     "source": "https://cohere.com/privacy",
     "checked": "2026-10-21"
    },
    "retention": {
     "value": "30 days",
     "detail": "SaaS platform logs are deleted after 30 days unless flagged, contractually required, or opted into training.",
     "quote": "We automatically delete logged prompts and generations after 30 days, unless we need it to comply with a legal requirement or customer contract, or unless your usage is flagged as potentially violating our terms",
     "source": "https://cohere.com/data-usage-policy",
     "checked": "2026-10-21"
    },
    "zdr": {
     "value": "on request (enterprise)",
     "detail": "Email support@cohere.com. Only for enterprise customers who make extra usage commitments. Usage data is still collected.",
     "quote": "we only allow ZDR for enterprise customers who can make additional commitments about their usage of the Cohere Services.",
     "source": "https://cohere.com/data-usage-policy",
     "checked": "2026-10-21"
    },
    "abuse_monitoring": {
     "value": "flagged data reviewed",
     "detail": "Flagged prompts/generations can be retained and reviewed; de-identified flagged data may be aggregated for safety evaluation.",
     "quote": "If your usage is flagged as potentially violating our terms, including the Usage Policy, we may retain and review the flagged user prompts and associated logs to enforce our policies.",
     "source": "https://cohere.com/data-usage-policy",
     "checked": "2026-10-21"
    },
    "residency": {
     "value": "US only (Google Cloud US-Central)",
     "detail": "The SaaS platform runs on Google Cloud in US-Central, with no servers outside the US. Cohere can set up an 'ephemeral' mode where customer data is not stored. Private and third-party cloud deployments keep data in your own environment.",
     "quote": "Our hosting centers are on Google Cloud Platform servers located in US-Central. We do not use servers outside of the US",
     "source": "https://trustcenter.cohere.com/subprocessors",
     "checked": "2026-10-21"
    },
    "certifications": {
     "value": "SOC 2 Type II; ISO 27001; ISO 42001",
     "detail": "",
     "quote": "request a copy of our certifications (including ISO 27001 and ISO 42001) or of our SOC 2 Type II Report",
     "source": "https://cohere.com/data-usage-policy",
     "checked": "2026-10-21"
    },
    "hipaa_baa": {
     "value": "yes (custom model development)",
     "detail": "Announced Nov 2025 for custom model development engagements. Whether it extends to the hosted API is not stated.",
     "quote": "We are pleased to offer a HIPAA-compliant Business Associate agreement (BAA) to enable customers across the healthcare industry to work with us to develop secure custom models that meet their specific business needs.",
     "source": "https://cohere.com/blog/hipaa-business-associate-agreements-for-custom-model-development",
     "checked": "2026-10-21"
    },
    "self_host": {
     "value": "yes (private deployment)",
     "detail": "VPC, on-premises, or Cohere-managed Model Vault; Cohere states it has no access to data in private deployments.",
     "quote": "Deploy through your virtual private cloud (VPC), on-premises setup, or dedicated, Cohere-managed Model Vault.",
     "source": "https://cohere.com/security",
     "checked": "2026-10-21"
    }
   }
  },
  {
   "slug": "xai",
   "name": "xAI API (Grok)",
   "category": "Model APIs",
   "vendor": "xAI (pages now branded “SpaceXSI”)",
   "region_filter": "none",
   "notes": "",
   "fields": {
    "trains_by_default": {
     "value": "no",
     "detail": "Per the Enterprise Terms of Service (last updated Aug 14, 2026). De-identified aggregate data may still be used unless you use ZDR.",
     "quote": "SpaceXSI will not use any User Content to train any foundation models, large language models, or other artificial intelligence systems",
     "source": "https://x.ai/legal/terms-of-service-enterprise",
     "checked": "2026-10-21"
    },
    "retention": {
     "value": "30 days",
     "detail": "Deleted within 30 days of the session ending, unless agreed otherwise, legally required, or needed for safety/abuse investigation.",
     "quote": "All User Content will be automatically and permanently deleted no later than 30 days after the end of the interaction or session in which it was submitted",
     "source": "https://x.ai/legal/terms-of-service-enterprise",
     "checked": "2026-10-21"
    },
    "zdr": {
     "value": "yes (ZDR-enabled API)",
     "detail": "Under ZDR, content is deleted within an hour and no logs are kept, including for safety.",
     "quote": "no logs, backups, persistent copies, or other durable storage containing User Content will thereafter be retained for any purpose, including safety, debugging, or legal compliance.",
     "source": "https://x.ai/legal/terms-of-service-enterprise",
     "checked": "2026-10-21"
    },
    "abuse_monitoring": {
     "value": "extends retention (non-ZDR)",
     "detail": "Outside ZDR, retention can exceed 30 days for safety, moderation or abuse investigation.",
     "quote": "reasonably necessary for safety, security, compliance, moderation, abuse prevention, or investigation of suspected violations of this Agreement",
     "source": "https://x.ai/legal/terms-of-service-enterprise",
     "checked": "2026-10-21"
    },
    "residency": {
     "value": "global or US",
     "detail": "Global endpoint may route between regions. US endpoint (us.api.x.ai) pins handling to the US, costs 10% more, and supports fewer models.",
     "quote": "SpaceXSI may route requests between regions for capacity or reliability, so the processing location is not guaranteed.",
     "source": "https://docs.x.ai/docs/key-information/regions",
     "checked": "2026-10-21"
    },
    "certifications": {
     "value": "SOC 2 Type 2",
     "detail": "Report available to customers under NDA via the Trust Center. ISO 27001 not stated.",
     "quote": "We are SOC 2 Type 2 compliant.",
     "source": "https://docs.x.ai/console/faq/security",
     "checked": "2026-10-21"
    },
    "hipaa_baa": {
     "value": "yes (referenced)",
     "detail": "Terms require a BAA before submitting PHI, which implies one is offered.",
     "quote": "unless Customer has first entered into a Business Associate Agreement or Amendment",
     "source": "https://x.ai/legal/terms-of-service-enterprise",
     "checked": "2026-10-21"
    },
    "self_host": {
     "value": "partial (older open weights)",
     "detail": "The API is hosted only. xAI has published weights for older models (Grok 1, Grok 2) on Hugging Face; current API models are not downloadable.",
     "quote": "This repository contains the weights of Grok 2, a model trained and used at xAI in 2024.",
     "source": "https://huggingface.co/xai-org/grok-2",
     "checked": "2026-10-21"
    }
   }
  },
  {
   "slug": "deepseek",
   "name": "DeepSeek API",
   "category": "Model APIs",
   "vendor": "Hangzhou DeepSeek Artificial Intelligence Co., Ltd.",
   "region_filter": "none",
   "notes": "",
   "fields": {
    "trains_by_default": {
     "value": "unverified",
     "detail": "DeepSeek says a small portion of optimization-training data may be based on user input (de-identified, with an opt-out), but neither this page nor the Open Platform terms say whether API inputs are included.",
     "quote": "",
     "source": "https://cdn.deepseek.com/policies/en-US/model-algorithm-disclosure.html",
     "checked": "2026-10-21"
    },
    "retention": {
     "value": "not fixed (prompt cache: hours to days)",
     "detail": "Every API request builds an on-disk context cache, on for all users, cleared 'usually within a few hours to a few days' once unused. Other retention is 'as long as necessary' per the privacy policy; no API log period is published.",
     "quote": "Once the cache is no longer in use, it will be automatically cleared, usually within a few hours to a few days.",
     "source": "https://api-docs.deepseek.com/guides/kv_cache",
     "checked": "2026-10-21"
    },
    "zdr": {
     "value": "unverified",
     "detail": "No ZDR option found. Disk context caching is enabled by default for all users and no way to turn it off is documented.",
     "quote": "",
     "source": "https://api-docs.deepseek.com/guides/kv_cache",
     "checked": "2026-10-21"
    },
    "abuse_monitoring": {
     "value": "unverified",
     "detail": "No abuse-monitoring retention terms found on the pages checked.",
     "quote": "",
     "source": "https://cdn.deepseek.com/policies/en-US/deepseek-open-platform-terms-of-service.html",
     "checked": "2026-10-21"
    },
    "residency": {
     "value": "PRC only",
     "detail": "No region choice. Data is processed and stored in the People's Republic of China.",
     "quote": "we directly collect, process and store your Personal Data in People's Republic of China.",
     "source": "https://cdn.deepseek.com/policies/en-US/deepseek-privacy-policy.html",
     "checked": "2026-10-21"
    },
    "certifications": {
     "value": "unverified",
     "detail": "No certification statement found.",
     "quote": "",
     "source": "https://cdn.deepseek.com/policies/en-US/deepseek-privacy-policy.html",
     "checked": "2026-10-21"
    },
    "hipaa_baa": {
     "value": "unverified",
     "detail": "Not stated.",
     "quote": "",
     "source": "https://cdn.deepseek.com/policies/en-US/deepseek-open-platform-terms-of-service.html",
     "checked": "2026-10-21"
    },
    "self_host": {
     "value": "yes (open weights)",
     "detail": "DeepSeek publishes model weights on Hugging Face (e.g. DeepSeek-V4.1-Flash-1017 at time of check), so you can run them yourself without using the API.",
     "quote": "deepseek-ai/DeepSeek-V4.1-Flash-1017",
     "source": "https://huggingface.co/deepseek-ai",
     "checked": "2026-10-21"
    }
   }
  },
  {
   "slug": "groq",
   "name": "Groq",
   "category": "Model APIs",
   "vendor": "Groq",
   "region_filter": "none",
   "notes": "",
   "fields": {
    "trains_by_default": {
     "value": "no",
     "detail": "Per the Groq Services Agreement.",
     "quote": "For clarity, Groq is not permitted to use Inputs or Outputs for training or fine-tuning any AI Model Services or other models, unless explicitly granted permission or instructed by Customer.",
     "source": "https://console.groq.com/docs/legal/services-agreement",
     "checked": "2026-10-21"
    },
    "retention": {
     "value": "none by default",
     "detail": "Inference inputs/outputs are not retained by default. Batch and fine-tuning keep data as needed.",
     "quote": "By default, Groq does not retain customer data for inference requests.",
     "source": "https://console.groq.com/docs/your-data",
     "checked": "2026-10-21"
    },
    "zdr": {
     "value": "yes (self-serve)",
     "detail": "Any customer can switch on ZDR in Data Controls settings. Features that need storage get disabled.",
     "quote": "All customers may enable Zero Data Retention (ZDR) in",
     "source": "https://console.groq.com/docs/your-data",
     "checked": "2026-10-21"
    },
    "abuse_monitoring": {
     "value": "up to 30 days, opt-out",
     "detail": "Temporary logging for reliability or abuse investigation, up to 30 days; ZDR switches it off.",
     "quote": "These logs are retained for up to",
     "source": "https://console.groq.com/docs/your-data",
     "checked": "2026-10-21"
    },
    "residency": {
     "value": "US only",
     "detail": "Stored in GCP buckets in the United States.",
     "quote": "All customer data is retained in Google Cloud Platform (GCP) buckets located in the United States.",
     "source": "https://console.groq.com/docs/your-data",
     "checked": "2026-10-21"
    },
    "certifications": {
     "value": "SOC 2 Type II",
     "detail": "Stated in the DPA's security measures. ISO 27001 not confirmed (trust portal is JavaScript-rendered).",
     "quote": "Annual engagements of a qualified, independent external auditor to conduct periodic reviews of Groq’s security practices against recognized audit standards, including SOC 2 Type II certification audits.",
     "source": "https://console.groq.com/docs/legal/customer-data-processing-addendum",
     "checked": "2026-10-21"
    },
    "hipaa_baa": {
     "value": "yes (BAA addendum)",
     "detail": "Groq publishes a Business Associate Addendum (effective 15 Oct 2025) that supplements the Groq Services Agreement for covered GroqCloud services.",
     "quote": "supplements, amends, and is incorporated into the Groq Services Agreement",
     "source": "https://console.groq.com/docs/legal/customer-business-associate-addendum",
     "checked": "2026-10-21"
    },
    "self_host": {
     "value": "unverified",
     "detail": "No self-hosted option documented on the GroqCloud pages checked. groq.com/groqrack (the old on-prem rack product page) now shows the general home page.",
     "quote": "",
     "source": "https://console.groq.com/docs/your-data",
     "checked": "2026-10-21"
    }
   }
  },
  {
   "slug": "cursor",
   "name": "Cursor",
   "category": "Coding tools",
   "vendor": "Anysphere (Cursor)",
   "region_filter": "none",
   "notes": "",
   "fields": {
    "trains_by_default": {
     "value": "depends",
     "detail": "With Privacy Mode on: no training. With Privacy Mode off: Cursor may store and train on code, prompts and editor actions. The pages checked do not state which mode new individual accounts start in.",
     "quote": "If you choose to turn off “Privacy Mode”: we may use and store codebase data, prompts, editor actions, code snippets, and other code data and actions to improve our AI features and train our models.",
     "source": "https://cursor.com/data-use",
     "checked": "2026-10-21"
    },
    "retention": {
     "value": "Privacy Mode: transient; off: stored",
     "detail": "With Privacy Mode on, providers are under ZDR agreements, file caches are temporary, and Cloud Agent repo copies are deleted when the agent completes. With it off, Cursor may store code data to train. No fixed period is published. Some models (e.g. Claude Fable 5/5.1) need provider-side retention and admin approval.",
     "quote": "Deleted after the agent completes",
     "source": "https://cursor.com/docs/enterprise/privacy-and-data-governance",
     "checked": "2026-10-21"
    },
    "zdr": {
     "value": "yes (Privacy Mode)",
     "detail": "Privacy Mode relies on ZDR agreements with model providers. Non-ZDR models are labelled or need admin opt-in.",
     "quote": "Cursor maintains zero data retention (ZDR) agreements with all providers, and AI model providers will not store or train on your data.",
     "source": "https://cursor.com/data-use",
     "checked": "2026-10-21"
    },
    "abuse_monitoring": {
     "value": "exception applies",
     "detail": "Even in Privacy Mode, content that trips abuse classifiers may be stored.",
     "quote": "if your prompts or conversations trigger abuse detectors your data may be stored for investigation and deleted in accordance with their retention policies.",
     "source": "https://cursor.com/data-use",
     "checked": "2026-10-21"
    },
    "residency": {
     "value": "US-only (Enterprise); EU+UK inference on request",
     "detail": "Enterprise teams can enable US-only residency for inference, processing and storage (10% model price uplift; limited model list; BYOK not covered). EU+UK inference-only coverage on request. No APAC region.",
     "quote": "EU + UK inference-only coverage is available on request. Broader EU support and additional regions are in active development.",
     "source": "https://cursor.com/docs/enterprise/privacy-and-data-governance",
     "checked": "2026-10-21"
    },
    "certifications": {
     "value": "SOC 2 Type II; ISO 27001; ISO 42001; AIUC-1",
     "detail": "",
     "quote": "Cursor holds AIUC-1, ISO/IEC 27001:2022, and ISO/IEC 42001:2023 certifications, along with a SOC 2 Type II attestation.",
     "source": "https://cursor.com/security",
     "checked": "2026-10-21"
    },
    "hipaa_baa": {
     "value": "yes (Enterprise)",
     "detail": "BAA on the Enterprise plan via sales. Requires Privacy Mode enabled and locked org-wide; only listed Eligible Services and Models are covered, and third-party integrations are not.",
     "quote": "Cursor supports HIPAA Business Associate Agreements (BAAs) for Enterprise customers.",
     "source": "https://cursor.com/docs/enterprise/baa",
     "checked": "2026-10-21"
    },
    "self_host": {
     "value": "partial (agent tool execution only)",
     "detail": "Self-Hosted Machines move Cloud Agent tool execution (file edits, terminal, MCP) onto your machines. Inference, planning and the agent loop stay with Cursor.",
     "quote": "Cursor runs the agent loop, inference, and planning.",
     "source": "https://cursor.com/docs/cloud-agent/self-hosted",
     "checked": "2026-10-21"
    }
   }
  },
  {
   "slug": "github-copilot",
   "name": "GitHub Copilot",
   "category": "Coding tools",
   "vendor": "GitHub (Microsoft)",
   "region_filter": "apac",
   "notes": "",
   "fields": {
    "trains_by_default": {
     "value": "depends",
     "detail": "Free, Pro and Pro+: used for training unless you opt out at github.com/settings/copilot/features (change effective 'April 24'). Business and Enterprise: never.",
     "quote": "GitHub may also use interactions from users with a Copilot Free, Copilot Pro, and Copilot Pro+ subscription - including inputs, outputs, code snippets, and associated context - to train and improve our AI models unless they have opted out.",
     "source": "https://github.com/features/copilot",
     "checked": "2026-10-21"
    },
    "retention": {
     "value": "0 days (IDE) / 28 days (other)",
     "detail": "Business/Enterprise: IDE chat and completions are not retained. Chat on github.com, mobile and CLI keeps prompts 28 days. Engagement data: 2 years.",
     "quote": "Prompts and Suggestions: Retained for 28 days.",
     "source": "https://github.com/features/copilot",
     "checked": "2026-10-21"
    },
    "zdr": {
     "value": "partial",
     "detail": "No named ZDR program. For Business/Enterprise, IDE prompts and suggestions are not retained by default.",
     "quote": "Prompts and Suggestions: Not retained",
     "source": "https://github.com/features/copilot",
     "checked": "2026-10-21"
    },
    "abuse_monitoring": {
     "value": "provider ZDR, except Claude Fable 5 / 5.1 (Anthropic retains)",
     "detail": "Copilot runs real-time content filters on all prompts and outputs. GitHub has ZDR agreements with OpenAI, Anthropic (GA features) and xAI, and Google does not log prompts for abuse monitoring. Exception: Anthropic retains prompts and outputs for Claude Fable 5 / 5.1 to run safety classifiers; a ZDR exemption is available to eligible customers until the end of 2026.",
     "quote": "When Claude Fable 5 or Claude Fable 5.1 is used, Anthropic retains data, including prompts and outputs, by default to operate safety classifiers that detect harmful use.",
     "source": "https://docs.github.com/en/copilot/reference/ai-models/model-hosting",
     "checked": "2026-10-23"
    },
    "residency": {
     "value": "EU, Australia, US, Japan (GHE.com)",
     "detail": "Via GitHub Enterprise Cloud with data residency. No Singapore region listed. Some Copilot features unavailable on GHE.com.",
     "quote": "The available regions are:",
     "source": "https://docs.github.com/en/enterprise-cloud@latest/admin/data-residency/about-github-enterprise-cloud-with-data-residency",
     "checked": "2026-10-21"
    },
    "certifications": {
     "value": "SOC 2 Type II; ISO 27001",
     "detail": "Copilot Business and Enterprise are covered by GitHub's SOC 2 Type II report and its ISO 27001 scope.",
     "quote": "include GitHub Enterprise Cloud for github.com with all new regions like the EU, as well as Copilot Business and Enterprise.",
     "source": "https://github.blog/changelog/2024-12-06-the-latest-github-and-github-copilot-soc-reports-are-now-available/",
     "checked": "2026-10-21"
    },
    "hipaa_baa": {
     "value": "no (DPA bars PHI without consent)",
     "detail": "No BAA for Copilot was found. Copilot falls under the GitHub Data Protection Agreement (October 2025), which says customers must not give GitHub HIPAA protected health information without GitHub's prior, written and specific consent.",
     "quote": "Except with GitHub’s prior, written, and specific consent, You shall not provide GitHub any Personal Data: … constituting protected health information",
     "source": "https://assets.ctfassets.net/8aevphvgewt8/9rRh60u9m8AJGCKPHSnkI/f665de2992d6aa66bab425d19a559dd1/TPL-202510-GitHubDataProtectionAgreement.pdf",
     "checked": "2026-10-21"
    },
    "self_host": {
     "value": "partial (CLI air-gapped, preview)",
     "detail": "Copilot itself runs on GitHub.com / GHE.com. A technical-preview mode lets Copilot CLI work with GitHub Enterprise Server in air-gapped setups using an admin-configured model provider.",
     "quote": "you can configure Copilot CLI to work with GitHub Enterprise Server in disconnected or air-gapped environments, without connecting to GitHub's cloud platforms or requiring a Copilot license.",
     "source": "https://docs.github.com/en/enterprise-server@3.22/copilot/copilot-on-ghes/about-copilot-on-ghes",
     "checked": "2026-10-21"
    }
   }
  },
  {
   "slug": "claude-code",
   "name": "Claude Code",
   "category": "Coding tools",
   "vendor": "Anthropic",
   "region_filter": "none",
   "notes": "",
   "fields": {
    "trains_by_default": {
     "value": "depends",
     "detail": "Team, Enterprise and API: not trained on. Free, Pro and Max accounts: trained on when the user's model-improvement setting is on.",
     "quote": "Anthropic does not train generative models using code or prompts sent to Claude Code under commercial terms",
     "source": "https://code.claude.com/docs/en/data-usage",
     "checked": "2026-10-21"
    },
    "retention": {
     "value": "30 days (commercial)",
     "detail": "Commercial: 30 days. Consumer: 5 years if training is allowed, else 30 days. The client also keeps plaintext transcripts in ~/.claude/projects for 30 days.",
     "quote": "Standard: 30-day retention period",
     "source": "https://code.claude.com/docs/en/data-usage",
     "checked": "2026-10-21"
    },
    "zdr": {
     "value": "Enterprise, on request",
     "detail": "Available to qualified Claude for Enterprise accounts, enabled per organization. ZDR also applies with API keys from a commercial org that has ZDR.",
     "quote": "ZDR is not included in the standard Enterprise plan; it is enabled on a per-organization basis by your account team after confirming eligibility",
     "source": "https://code.claude.com/docs/en/data-usage",
     "checked": "2026-10-21"
    },
    "abuse_monitoring": {
     "value": "2 years if flagged",
     "detail": "Same Anthropic commercial policy as the API.",
     "quote": "We retain inputs and outputs for up to 2 years and trust and safety classification scores for up to 7 years if your chat is flagged by our automated trust and safety systems as violating our",
     "source": "https://privacy.anthropic.com/en/articles/7996866-how-long-do-you-store-my-organization-s-data",
     "checked": "2026-10-21"
    },
    "residency": {
     "value": "US or global",
     "detail": "Inherits API controls: inference_geo 'global' or 'us'. No APAC option documented.",
     "quote": "Default. Inference may run in any available geography for optimal performance and availability.",
     "source": "https://docs.anthropic.com/en/docs/build-with-claude/data-residency",
     "checked": "2026-10-21"
    },
    "certifications": {
     "value": "SOC 2 Type I & II; ISO 27001; ISO 42001",
     "detail": "Anthropic company-level certifications.",
     "quote": "SOC 2 Type I & Type II",
     "source": "https://privacy.anthropic.com/en/articles/10015870-what-certifications-has-anthropic-obtained",
     "checked": "2026-10-21"
    },
    "hipaa_baa": {
     "value": "yes",
     "detail": "Anthropic lists a HIPAA-ready configuration with a BAA.",
     "quote": "HIPAA-ready configuration (BAA available)",
     "source": "https://privacy.anthropic.com/en/articles/10015870-what-certifications-has-anthropic-obtained",
     "checked": "2026-10-21"
    },
    "self_host": {
     "value": "partial (session runners, beta)",
     "detail": "Self-hosted environments (public beta, Team/Enterprise, off by default) run cloud sessions on your infrastructure. Model inference still goes to Anthropic, Bedrock or Google Cloud, session content goes to Anthropic, and the feature is unavailable with ZDR or the HIPAA configuration.",
     "quote": "A self-hosted environment executes Claude Code cloud sessions on infrastructure your organization operates.",
     "source": "https://code.claude.com/docs/en/self-hosted-environments",
     "checked": "2026-10-21"
    }
   }
  },
  {
   "slug": "openai-codex",
   "name": "OpenAI Codex",
   "category": "Coding tools",
   "vendor": "OpenAI",
   "region_filter": "unverified",
   "notes": "",
   "fields": {
    "trains_by_default": {
     "value": "depends",
     "detail": "Business, Enterprise/Edu and API key: no training by default. Personal ChatGPT plans are not covered by that row and were not verified here.",
     "quote": "No training on your business data by default.",
     "source": "https://developers.openai.com/codex/pricing",
     "checked": "2026-10-21"
    },
    "retention": {
     "value": "follows workspace / API org settings",
     "detail": "ChatGPT sign-in follows the ChatGPT Enterprise workspace's retention and residency settings; API-key sign-in follows the API organization's settings. For ChatGPT-authenticated use, audit records are kept up to 30 days for the Compliance API.",
     "quote": "For usage authenticated through ChatGPT, OpenAI keeps audit records for up to 30 days so you can retrieve them through the",
     "source": "https://learn.chatgpt.com/docs/hipaa-configuration",
     "checked": "2026-10-21"
    },
    "zdr": {
     "value": "unverified",
     "detail": "No Codex-level ZDR switch is documented. With API-key sign-in, Codex follows the API organization's retention settings (where ZDR is configured). OpenAI warns that Work Cloud with local computer access does not provide strict ZDR.",
     "quote": "",
     "source": "https://developers.openai.com/codex/enterprise",
     "checked": "2026-10-21"
    },
    "abuse_monitoring": {
     "value": "unverified",
     "detail": "Not stated on the Codex pages checked.",
     "quote": "",
     "source": "https://developers.openai.com/codex/enterprise",
     "checked": "2026-10-21"
    },
    "residency": {
     "value": "follows ChatGPT Enterprise settings",
     "detail": "Codex inherits the workspace's residency settings, but OpenAI notes residency covers only eligible content, workloads, regions and configurations. Regions are not listed on the Codex pages.",
     "quote": "Data residency and inference residency cover only eligible content and supported workloads, regions, and configurations.",
     "source": "https://developers.openai.com/codex/enterprise",
     "checked": "2026-10-21"
    },
    "certifications": {
     "value": "unverified",
     "detail": "No Codex-specific certification statement found.",
     "quote": "",
     "source": "https://developers.openai.com/codex/enterprise",
     "checked": "2026-10-21"
    },
    "hipaa_baa": {
     "value": "yes (local Codex only)",
     "detail": "Covered under an OpenAI BAA for the desktop app, IDE extension and CLI with ChatGPT sign-in on HIPAA-eligible workspaces, or API-key sign-in only if the BAA includes API Services with Modified Retention. Codex cloud is excluded.",
     "quote": "The BAA doesn’t cover Codex cloud. Don’t use Codex cloud with PHI.",
     "source": "https://learn.chatgpt.com/docs/hipaa-configuration",
     "checked": "2026-10-21"
    },
    "self_host": {
     "value": "partial (local OSS models)",
     "detail": "The CLI can run against a local open-source model through Ollama or LM Studio with --oss. The Codex service itself (cloud tasks, OpenAI models) is hosted only.",
     "quote": "Use a local open source model provider.",
     "source": "https://developers.openai.com/codex/cli/reference",
     "checked": "2026-10-21"
    }
   }
  },
  {
   "slug": "windsurf",
   "name": "Windsurf (Devin Desktop)",
   "category": "Coding tools",
   "vendor": "Cognition",
   "region_filter": "none",
   "notes": "",
   "fields": {
    "trains_by_default": {
     "value": "depends",
     "detail": "The windsurf.com security page now carries Cognition's Devin-wide terms: default may train; paid plans can opt out; Enterprise is not trained on without written consent. No Windsurf-specific wording was found.",
     "quote": "By default, we may use your data for model training purposes to improve and enhance the Services. If you’re on a paid plan, you can opt out at any time on the Data Controls settings page.",
     "source": "https://windsurf.com/security",
     "checked": "2026-10-21"
    },
    "retention": {
     "value": "deleted after output (MSA customers)",
     "detail": "The Windsurf MSA (Exafunction) data-use guidelines say customer data is deleted once output is generated and not stored at rest. Exceptions on cloud plans: features that need persistence (indexing, memories etc.), AUP-flagged input, and profile data. Retention for self-serve users on the consumer terms was not confirmed.",
     "quote": "is deleted once Output is generated",
     "source": "https://devin.ai/windsurf/msa",
     "checked": "2026-10-21"
    },
    "zdr": {
     "value": "on opt-out (paid)",
     "detail": "After opting out of training, ZDR is enabled with model providers.",
     "quote": "After you opt out, your data will not be used for training and Zero Data Retention will be enabled with our model providers.",
     "source": "https://windsurf.com/security",
     "checked": "2026-10-21"
    },
    "abuse_monitoring": {
     "value": "30 days for opt-in models",
     "detail": "Teams/Enterprise admins can unlock Anthropic and OpenAI models that require retention for trust-and-safety checks; those providers keep data up to 30 days and do not train on it. Otherwise ZDR applies after training opt-out.",
     "quote": "Unlocks additional Anthropic models that require data retention for trust and safety verification. Anthropic stores this data for up to 30 days and does not train on it.",
     "source": "https://docs.devin.ai/desktop/controls",
     "checked": "2026-10-21"
    },
    "residency": {
     "value": "US (core); EU cluster for Enterprise",
     "detail": "The core cluster is in the US. A Frankfurt cluster for European enterprise customers keeps processing and retention in the EU (announced in the Wave 10 blog post). A FedRAMP deployment runs on AWS GovCloud. No Asia or Singapore region found.",
     "quote": "A datacenter in Frankfurt for our European enterprise customers that guarantees that all data processing and data retention stays within EU borders.",
     "source": "https://devin.ai/blog/windsurf-wave-10-ux-enterprise",
     "checked": "2026-10-21"
    },
    "certifications": {
     "value": "SOC 2 Type II",
     "detail": "Cognition-level attestation.",
     "quote": "Cognition has been SOC 2 Type II certified since September 2024.",
     "source": "https://windsurf.com/security",
     "checked": "2026-10-21"
    },
    "hipaa_baa": {
     "value": "no (MSA bars PHI)",
     "detail": "The Windsurf MSA tells customers not to share protected health information. No BAA offer found.",
     "quote": "You agree not to share with us or otherwise process any protected health information.",
     "source": "https://devin.ai/windsurf/msa",
     "checked": "2026-10-21"
    },
    "self_host": {
     "value": "no for new customers (Hybrid instead)",
     "detail": "The self-hosted deployment is in maintenance mode: current customers are supported until the end of their term, but no new customers are taken. A Hybrid deployment keeps persisted data in a customer-controlled instance.",
     "quote": "we are no longer investing in feature development or bringing on new customers to the self-hosted platform.",
     "source": "https://devin.ai/blog/self-hosted-deployment-maintenance-mode",
     "checked": "2026-10-21"
    }
   }
  },
  {
   "slug": "jetbrains-ai",
   "name": "JetBrains AI",
   "category": "Coding tools",
   "vendor": "JetBrains",
   "region_filter": "none",
   "notes": "",
   "fields": {
    "trains_by_default": {
     "value": "depends",
     "detail": "Detailed code-related data (full prompts, responses, code snippets) can train models. Organizational licenses: disallowed unless a company admin enables it. Individual non-commercial licenses: collected by default with opt-out.",
     "quote": "We do not collect Detailed code-related data from our commercial users unless explicit, informed consent has been obtained in advance.",
     "source": "https://www.jetbrains.com/help/ai/data-collection-and-use-policy.html",
     "checked": "2026-10-21"
    },
    "retention": {
     "value": "1 year (if shared)",
     "detail": "Applies to detailed code-related data when collection is enabled.",
     "quote": "We apply a 1-year data retention period for this data.",
     "source": "https://www.jetbrains.com/help/ai/data-collection-and-use-policy.html",
     "checked": "2026-10-21"
    },
    "zdr": {
     "value": "unverified",
     "detail": "No ZDR offering is named. JetBrains says it persists no customer data unless detailed data collection is enabled, but its terms allow abuse-monitoring storage for a limited period, and provider-side retention is not specified.",
     "quote": "",
     "source": "https://lp.jetbrains.com/ai-ides-faq/",
     "checked": "2026-10-21"
    },
    "abuse_monitoring": {
     "value": "yes, limited period (unspecified)",
     "detail": "Inputs and outputs may be monitored by JetBrains or its AI subcontractors for acceptable-use violations and stored for a limited period. No length is given.",
     "quote": "Your Inputs, Data, Outputs, and Suggestions may be monitored by Us or AI Subcontractors (as defined below) to prevent the violation of applicable acceptable use policies and may be stored and used for a limited period.",
     "source": "https://www.jetbrains.com/legal/docs/terms/jetbrains-ai-platform/",
     "checked": "2026-10-21"
    },
    "residency": {
     "value": "provider-dependent, mostly US",
     "detail": "No region choice for the hosted service. The subprocessor list gives data-centre locations: OpenAI US, Google EU/US/Asia, Anthropic US, xAI US. Data collected under detailed data collection stays in the EEA. On-prem AI Enterprise avoids this.",
     "quote": "OpenAI US Google EU, US, and Asia Anthropic US xAI US",
     "source": "https://www.jetbrains.com/legal/docs/privacy/third-parties/",
     "checked": "2026-10-21"
    },
    "certifications": {
     "value": "SOC 2 Type II",
     "detail": "Company-level, per the JetBrains Trust Center page. ISO 27001 is not confirmed on the pages read.",
     "quote": "You can also find details on our SOC 2 Type II and GDPR compliance",
     "source": "https://www.jetbrains.com/legal/docs/privacy/trust-center/",
     "checked": "2026-10-21"
    },
    "hipaa_baa": {
     "value": "unverified",
     "detail": "Not stated.",
     "quote": "",
     "source": "https://www.jetbrains.com/help/ai/data-collection-and-use-policy.html",
     "checked": "2026-10-21"
    },
    "self_host": {
     "value": "yes (AI Enterprise on-prem)",
     "detail": "AI Enterprise via IDE Services can run air-gapped against on-prem OpenAI-compatible servers (llama.cpp, vLLM, LM Studio) and self-hosted Mellum. Individual IDEs can also use local models through Ollama or LM Studio.",
     "quote": "IDE Services supports the following on-premises solutions for air-gapped operations of AI Enterprise.",
     "source": "https://www.jetbrains.com/help/ide-services/aie-on-premises.html",
     "checked": "2026-10-21"
    }
   }
  },
  {
   "slug": "openrouter",
   "name": "OpenRouter",
   "category": "Inference hosts & routers",
   "vendor": "OpenRouter",
   "region_filter": "none",
   "notes": "",
   "fields": {
    "trains_by_default": {
     "value": "depends on provider",
     "detail": "OpenRouter itself does not train on inputs. Underlying providers may; an account setting blocks routing to providers that train.",
     "quote": "OpenRouter does not use your Inputs or Outputs for model training.",
     "source": "https://openrouter.ai/privacy",
     "checked": "2026-10-21"
    },
    "retention": {
     "value": "not logged by default",
     "detail": "OpenRouter says it does not log prompts by default (prompt logging is opt-in). Provider-side retention varies by provider and is shown per endpoint.",
     "quote": "Prompts are not logged by default.",
     "source": "https://openrouter.ai/enterprise",
     "checked": "2026-10-21"
    },
    "zdr": {
     "value": "yes (routing filter)",
     "detail": "Can enforce ZDR-only routing globally, per model group, per guardrail or per request. Endpoints with unclear policies are assumed to retain and train.",
     "quote": "If OpenRouter is not able to establish or ascertain a clear policy for a provider or endpoint, we take a conservative stance and assume that the endpoint both retains and trains on data and mark it as such.",
     "source": "https://openrouter.ai/docs/features/zdr",
     "checked": "2026-10-21"
    },
    "abuse_monitoring": {
     "value": "depends on provider",
     "detail": "Some providers that don't train still retain data for abuse scanning.",
     "quote": "we do have some endpoints & providers who do not train on your data but do retain it (e.g. to scan for abuse or for legal reasons).",
     "source": "https://openrouter.ai/docs/features/zdr",
     "checked": "2026-10-21"
    },
    "residency": {
     "value": "EU or US (Business/Enterprise)",
     "detail": "In-region routing via eu.openrouter.ai and us.openrouter.ai. No APAC option documented.",
     "quote": "On the Business and Enterprise plans, OpenRouter supports in-region routing in the EU and US.",
     "source": "https://openrouter.ai/docs/features/privacy-and-logging",
     "checked": "2026-10-21"
    },
    "certifications": {
     "value": "SOC 2 Type II",
     "detail": "Stated on the enterprise page.",
     "quote": "SOC 2 Type II. DPA with SCCs for GDPR programs.",
     "source": "https://openrouter.ai/enterprise",
     "checked": "2026-10-21"
    },
    "hipaa_baa": {
     "value": "unverified",
     "detail": "Not stated.",
     "quote": "",
     "source": "https://openrouter.ai/privacy",
     "checked": "2026-10-21"
    },
    "self_host": {
     "value": "unverified",
     "detail": "No self-hosted deployment of this service was documented on the pages checked.",
     "quote": "",
     "source": "https://openrouter.ai/docs/features/privacy-and-logging",
     "checked": "2026-10-21"
    }
   }
  },
  {
   "slug": "together-ai",
   "name": "Together AI",
   "category": "Inference hosts & routers",
   "vendor": "Together Computer",
   "region_filter": "unverified",
   "notes": "",
   "fields": {
    "trains_by_default": {
     "value": "no",
     "detail": "Only with explicit opt-in.",
     "quote": "We do not use any data collected from you to train our models without your explicit opt-in and consent.",
     "source": "https://www.together.ai/privacy",
     "checked": "2026-10-21"
    },
    "retention": {
     "value": "stored until deleted (default)",
     "detail": "By default Together stores prompts and responses and may use them for product improvement (not training). You can delete them, or switch storage off to get ZDR going forward.",
     "quote": "Unless your organization enables ZDR, Together stores the prompts you send and the responses models return, and may use them for product improvements.",
     "source": "https://docs.together.ai/docs/zero-data-retention",
     "checked": "2026-10-21"
    },
    "zdr": {
     "value": "yes (opt-in, org setting)",
     "detail": "Off by default. Admins set 'Store prompts and model responses' to No in Organization Settings; this also disables passthrough models. Not retroactive.",
     "quote": "ZDR is not enabled by default.",
     "source": "https://docs.together.ai/docs/zero-data-retention",
     "checked": "2026-10-21"
    },
    "abuse_monitoring": {
     "value": "none stated for content (uses metadata)",
     "detail": "The terms say abuse monitoring uses Usage Data (logs, metrics, metadata), which excludes your content. No separate abuse-monitoring retention of prompts is stated. Without ZDR, prompts are stored by default anyway (see Retention).",
     "quote": "Usage Data may include information such as system logs, performance metrics, model-usage statistics, metadata, and other operational information but excludes Your Content or any personal information. We may use the Usage Data for purposes including improving, maintaining, and securing the Services, developing new features or services, monitoring for abuse",
     "source": "https://www.together.ai/terms-of-service",
     "checked": "2026-10-21"
    },
    "residency": {
     "value": "unverified",
     "detail": "No region selection documented for serverless inference. The GPU clusters page says Asia and Middle East options are 'available based on the scale of the projects'.",
     "quote": "",
     "source": "https://www.together.ai/gpu-clusters",
     "checked": "2026-10-21"
    },
    "certifications": {
     "value": "SOC 2 Type 2",
     "detail": "Announced in a July 2025 company blog post. The trust portal (trust.together.ai) renders in JavaScript and was not read, so ISO 27001 is not confirmed here.",
     "quote": "Together AI has successfully completed a SOC 2 Type 2 examination.",
     "source": "https://www.together.ai/blog/soc-2-compliance",
     "checked": "2026-10-21"
    },
    "hipaa_baa": {
     "value": "no (standard terms bar medical data)",
     "detail": "The self-serve terms prohibit sending medical information. A company blog post mentions HIPAA practices and BAAs 'with our partners', but no customer BAA offer was found.",
     "quote": "You will not use the Services to transmit or provide to the Company any financial or medical information of any nature",
     "source": "https://www.together.ai/terms-of-service",
     "checked": "2026-10-21"
    },
    "self_host": {
     "value": "yes (Enterprise Platform)",
     "detail": "Together Enterprise Platform can be deployed in your own VPC (AWS, Azure, GCP, OCI) or on-premise. Announced in a 2024 blog post; pricing and current availability not stated.",
     "quote": "the Together Enterprise Platform can be deployed within your VPC or on-prem infrastructure.",
     "source": "https://www.together.ai/blog/introducing-the-together-enterprise-platform",
     "checked": "2026-10-21"
    }
   }
  },
  {
   "slug": "fireworks-ai",
   "name": "Fireworks AI",
   "category": "Inference hosts & routers",
   "vendor": "Fireworks AI",
   "region_filter": "none",
   "notes": "Fireworks published a security bulletin on an incident found on 6 Oct 2026: a third party used internal credentials to read environment variables (API keys, tokens) of evaluation jobs in a limited number of accounts. Fireworks says it found no evidence of access to prompts, outputs or models. Source: https://fireworks.ai/security/bulletins/october-2026-security-incident (checked 2026-10-21).",
   "fields": {
    "trains_by_default": {
     "value": "no",
     "detail": "Only with explicit opt-in.",
     "quote": "We do not use your prompts, training data, or API inputs to train or improve our AI models without your explicit opt-in.",
     "source": "https://fireworks.ai/privacy-policy",
     "checked": "2026-10-21"
    },
    "retention": {
     "value": "none by default (open models)",
     "detail": "Prompts live only in memory during the request. Exception: the Responses API stores conversations for 30 days because store=True is the default.",
     "quote": "Fireworks does not log or store prompt or generation data for any open models, without explicit user opt-in.",
     "source": "https://docs.fireworks.ai/guides/security_compliance/data_handling",
     "checked": "2026-10-21"
    },
    "zdr": {
     "value": "default",
     "detail": "ZDR is the default. Enterprise admins can also enforce a policy that rejects any request that would persist data.",
     "quote": "Fireworks has Zero Data Retention by default.",
     "source": "https://docs.fireworks.ai/guides/security_compliance/data_handling",
     "checked": "2026-10-21"
    },
    "abuse_monitoring": {
     "value": "none stated (no prompt logging for open models)",
     "detail": "For open models Fireworks logs only metadata such as token counts. No abuse-monitoring retention of prompts is described. Opt-in features and the Responses API (store=true) can keep data.",
     "quote": "Fireworks does not log or store prompt or generation data for any open models, without explicit user opt-in.",
     "source": "https://docs.fireworks.ai/guides/security_compliance/data_handling",
     "checked": "2026-10-21"
    },
    "residency": {
     "value": "US-only option (Enterprise enforcement)",
     "detail": "A US endpoint (us.api.fireworks.ai) serves selected models only from the US. Enterprise admins can enforce one region account-wide. Only 'None' and 'US' are listed; other regions via sales. No APAC option documented.",
     "quote": "Data residency restricts inference on your account to a single region.",
     "source": "https://docs.fireworks.ai/accounts/data-residency",
     "checked": "2026-10-21"
    },
    "certifications": {
     "value": "SOC 2 Type II; ISO 27001, 27701, 42001",
     "detail": "Listed on Fireworks' compliance docs page; certificates are in the Trust Center.",
     "quote": "Fireworks has achieved all three ISO certifications covering security, privacy, and AI management:",
     "source": "https://docs.fireworks.ai/faq/enterprise/compliance/certifications",
     "checked": "2026-10-21"
    },
    "hipaa_baa": {
     "value": "unverified",
     "detail": "Fireworks says it 'is HIPAA compliant', but no BAA offer is stated on the pages read.",
     "quote": "",
     "source": "https://docs.fireworks.ai/faq/enterprise/compliance/certifications",
     "checked": "2026-10-21"
    },
    "self_host": {
     "value": "partial (BYOC, private preview)",
     "detail": "Bring Your Own Cluster runs Fireworks inference in your own Kubernetes cluster, with Fireworks operating the serving stack. Enterprise only, private preview.",
     "quote": "Bring Your Own Cluster is in Private Preview for Enterprise customers.",
     "source": "https://docs.fireworks.ai/ecosystem/integrations/byoc/overview",
     "checked": "2026-10-21"
    }
   }
  },
  {
   "slug": "ollama-cloud",
   "name": "Ollama Cloud",
   "category": "Inference hosts & routers",
   "vendor": "Ollama",
   "region_filter": "none",
   "notes": "",
   "fields": {
    "trains_by_default": {
     "value": "no",
     "detail": "",
     "quote": "Ollama processes cloud prompts and responses to answer your requests. We do not use them to train models.",
     "source": "https://docs.ollama.com/cloud",
     "checked": "2026-10-21"
    },
    "retention": {
     "value": "transient",
     "detail": "Prompts and responses are not stored beyond the request.",
     "quote": "this content is not stored beyond the time required to fulfill the request.",
     "source": "https://ollama.com/privacy",
     "checked": "2026-10-21"
    },
    "zdr": {
     "value": "default",
     "detail": "Ollama says it requires no-logging and ZDR terms from the NVIDIA Cloud Providers that host its models.",
     "quote": "When Ollama partners with providers, we require no logging, no training, and zero data retention policies in place.",
     "source": "https://ollama.com/cloud",
     "checked": "2026-10-21"
    },
    "abuse_monitoring": {
     "value": "none stated (prompts never logged)",
     "detail": "Ollama says cloud prompts and responses are never logged, and its model partners must have no-logging and zero-retention policies. The privacy policy lists fraud and abuse prevention using account, device and usage data; its diagnostic metadata excludes prompt content.",
     "quote": "Prompt or response data is never logged or trained on.",
     "source": "https://ollama.com/cloud",
     "checked": "2026-10-21"
    },
    "residency": {
     "value": "US (may route to Europe)",
     "detail": "No region choice.",
     "quote": "Ollama hosts models and compute resources primarily in the United States. To serve global demand, we may route to Europe for additional capacity.",
     "source": "https://ollama.com/cloud",
     "checked": "2026-10-21"
    },
    "certifications": {
     "value": "unverified",
     "detail": "No certification statement found.",
     "quote": "",
     "source": "https://ollama.com/cloud",
     "checked": "2026-10-21"
    },
    "hipaa_baa": {
     "value": "unverified",
     "detail": "Not stated.",
     "quote": "",
     "source": "https://ollama.com/privacy",
     "checked": "2026-10-21"
    },
    "self_host": {
     "value": "yes (local Ollama)",
     "detail": "The same tool runs models entirely on your machine; cloud features can be disabled.",
     "quote": "We don’t see your prompts or data when you run locally.",
     "source": "https://ollama.com/privacy",
     "checked": "2026-10-21"
    }
   }
  },
  {
   "slug": "aws-bedrock",
   "name": "AWS Bedrock",
   "category": "Inference hosts & routers",
   "vendor": "Amazon Web Services",
   "region_filter": "sg",
   "notes": "",
   "fields": {
    "trains_by_default": {
     "value": "no",
     "detail": "Not used to train AWS or third-party models; not shared with model providers.",
     "quote": "AWS and the third-party model providers will not use any inputs to or outputs from Amazon Bedrock to train Amazon Nova, Amazon Titan, or any third-party models.",
     "source": "https://aws.amazon.com/bedrock/faqs/",
     "checked": "2026-10-21"
    },
    "retention": {
     "value": "none by default, with model-specific exceptions",
     "detail": "Zero-operator-access model, except: OpenAI models retain classifier-flagged traffic 30 days; Claude Fable 5/5.1 retain ALL traffic 30 days.",
     "quote": "For Anthropic Claude Fable 5 and Claude Fable 5.1, all traffic will be retained for up to 30 days for automated offline abuse detection.",
     "source": "https://docs.aws.amazon.com/bedrock/latest/userguide/abuse-detection.html",
     "checked": "2026-10-21"
    },
    "zdr": {
     "value": "default (most models)",
     "detail": "Full ZDR for OpenAI models is available on request via the AWS account team. Enterprise Frontier Safeguards customers get ZDR on Fable models only until Dec 31, 2026.",
     "quote": "Eligible customers may request full ZDR through their AWS account team.",
     "source": "https://docs.aws.amazon.com/bedrock/latest/userguide/abuse-detection.html",
     "checked": "2026-10-21"
    },
    "abuse_monitoring": {
     "value": "model-specific",
     "detail": "Retained data stays with AWS and lands in the destination region if cross-region inference is on. Flagged Fable traffic may get human review by AWS.",
     "quote": "Classifier-flagged traffic will be subject to potential human review performed by AWS.",
     "source": "https://docs.aws.amazon.com/bedrock/latest/userguide/abuse-detection.html",
     "checked": "2026-10-21"
    },
    "residency": {
     "value": "per AWS Region incl. Singapore",
     "detail": "Stored at rest in the Region you use. Runtime endpoint exists in Asia Pacific (Singapore) ap-southeast-1. Malaysia (ap-southeast-5) appears for the control plane only.",
     "quote": "Any customer content processed by Amazon Bedrock is encrypted and stored at rest in the AWS Region where you are using Amazon Bedrock.",
     "source": "https://aws.amazon.com/bedrock/faqs/",
     "checked": "2026-10-21"
    },
    "certifications": {
     "value": "SOC 1/2/3; ISO 27001 (+27017/27018/27701); FedRAMP Moderate; CSA STAR L2",
     "detail": "",
     "quote": "Amazon Bedrock is included in the scope of the SOC 1, 2, 3 reports",
     "source": "https://aws.amazon.com/bedrock/faqs/",
     "checked": "2026-10-21"
    },
    "hipaa_baa": {
     "value": "yes (HIPAA eligible)",
     "detail": "Covered under the AWS BAA as a HIPAA-eligible service.",
     "quote": "Health Insurance Portability and Accountability Act (HIPAA) eligibility",
     "source": "https://aws.amazon.com/bedrock/faqs/",
     "checked": "2026-10-21"
    },
    "self_host": {
     "value": "no (AWS-managed)",
     "detail": "Bedrock is a fully managed AWS service. Open-weight models can be self-hosted elsewhere, but not through Bedrock.",
     "quote": "Amazon Bedrock is a fully managed service",
     "source": "https://docs.aws.amazon.com/bedrock/latest/userguide/what-is-bedrock.html",
     "checked": "2026-10-21"
    }
   }
  },
  {
   "slug": "azure-openai",
   "name": "Azure OpenAI (Microsoft Foundry)",
   "category": "Inference hosts & routers",
   "vendor": "Microsoft",
   "region_filter": "unverified",
   "notes": "",
   "fields": {
    "trains_by_default": {
     "value": "no",
     "detail": "",
     "quote": "are NOT used to train any generative AI foundation models without your permission or instruction.",
     "source": "https://learn.microsoft.com/en-us/azure/ai-foundry/responsible-ai/openai/data-privacy",
     "checked": "2026-10-21"
    },
    "retention": {
     "value": "stateless; flagged samples stored",
     "detail": "No prompts stored by default except for stateful features (stored in your resource's geography) and abuse-flagged samples kept for human review. Retention period for flagged samples is not stated on the page.",
     "quote": "The models are stateless: no prompts or completions are stored in the model.",
     "source": "https://learn.microsoft.com/en-us/azure/ai-foundry/responsible-ai/openai/data-privacy",
     "checked": "2026-10-21"
    },
    "zdr": {
     "value": "on approval (modified abuse monitoring)",
     "detail": "Approved customers get no storage and no human review; automated review still runs.",
     "quote": "If the customer has been approved for modified abuse monitoring",
     "source": "https://learn.microsoft.com/en-us/azure/ai-foundry/responsible-ai/openai/data-privacy",
     "checked": "2026-10-21"
    },
    "abuse_monitoring": {
     "value": "human review of flagged samples",
     "detail": "Sampled prompts are reviewed by authorized Microsoft employees. Data is stored in the resource's geography.",
     "quote": "a sample of customer's prompts and completions may be selected for review.",
     "source": "https://learn.microsoft.com/en-us/azure/ai-foundry/responsible-ai/openai/data-privacy",
     "checked": "2026-10-21"
    },
    "residency": {
     "value": "resource geography (unless Global/DataZone)",
     "detail": "'Global' deployments may process anywhere; 'DataZone' within the zone. APAC/Singapore availability not verified here.",
     "quote": "prompts and responses may be processed in any geography where the relevant model sold by Azure is deployed",
     "source": "https://learn.microsoft.com/en-us/azure/ai-foundry/responsible-ai/openai/data-privacy",
     "checked": "2026-10-21"
    },
    "certifications": {
     "value": "unverified",
     "detail": "Microsoft lists in-scope services for ISO 27001 and SOC 2 in the 'Azure Compliance Offerings' PDF on the Service Trust Portal, which could not be downloaded without the portal. The public Learn pages do not name Azure OpenAI.",
     "quote": "",
     "source": "https://learn.microsoft.com/en-us/azure/compliance/offerings/cloud-services-in-audit-scope",
     "checked": "2026-10-21"
    },
    "hipaa_baa": {
     "value": "unverified",
     "detail": "Microsoft offers a HIPAA BAA via its Product Terms for in-scope services. The in-scope list is in a Service Trust Portal PDF that could not be read, so Azure OpenAI's inclusion is not confirmed here.",
     "quote": "",
     "source": "https://learn.microsoft.com/en-us/azure/compliance/offerings/offering-hipaa-us",
     "checked": "2026-10-21"
    },
    "self_host": {
     "value": "no (Azure-hosted)",
     "detail": "Azure OpenAI models are hosted and operated by Azure. (Foundry Local, which runs other models on-device, is a separate product.)",
     "quote": "Models sold by Azure are also hosted by Azure and operated by Azure as part of the Foundry Models service. They include all Azure OpenAI models",
     "source": "https://learn.microsoft.com/en-us/azure/foundry/foundry-models/concepts/models-sold-directly-by-azure?pivots=azure-openai",
     "checked": "2026-10-21"
    }
   }
  },
  {
   "slug": "langfuse",
   "name": "Langfuse",
   "category": "Eval & monitoring",
   "vendor": "Langfuse",
   "region_filter": "apac",
   "notes": "",
   "fields": {
    "trains_by_default": {
     "value": "no",
     "detail": "",
     "quote": "No. Langfuse does not train or fine‑tunes ML/LLM models on Client Data.",
     "source": "https://langfuse.com/security/privacy-faq",
     "checked": "2026-10-21"
    },
    "retention": {
     "value": "indefinite unless configured",
     "detail": "No automatic deletion without a retention policy (min 3 days, Pro/Enterprise). Self-hosted data is kept indefinitely by default.",
     "quote": "Without a retention policy, Langfuse does not automatically delete event data",
     "source": "https://langfuse.com/docs/data-retention",
     "checked": "2026-10-21"
    },
    "zdr": {
     "value": "n/a",
     "detail": "Observability product; storing traces is the point. Use retention settings or self-host.",
     "quote": "",
     "source": "https://langfuse.com/docs/data-retention",
     "checked": "2026-10-21"
    },
    "abuse_monitoring": {
     "value": "n/a",
     "detail": "Not applicable to an observability store.",
     "quote": "",
     "source": "https://langfuse.com/security",
     "checked": "2026-10-21"
    },
    "residency": {
     "value": "US, EU, Japan, HIPAA (US)",
     "detail": "Separate cloud regions: Oregon, Ireland, Tokyo, plus a HIPAA region in Oregon. No Singapore region.",
     "quote": "All data, user accounts, and infrastructure are completely separated between the regions.",
     "source": "https://langfuse.com/security/data-regions",
     "checked": "2026-10-21"
    },
    "certifications": {
     "value": "SOC 2 Type II; ISO 27001",
     "detail": "",
     "quote": "annual SOC2 Type 2 and ISO27001 audits",
     "source": "https://langfuse.com/security",
     "checked": "2026-10-21"
    },
    "hipaa_baa": {
     "value": "yes (HIPAA region, Pro+)",
     "detail": "Signed BAA available for Pro plan or higher in the separate HIPAA data region (hipaa.cloud.langfuse.com). Self-hosted deployments need no BAA with Langfuse.",
     "quote": "Eligible customers can enter into a signed Business Associate Agreement (BAA) with Langfuse for HIPAA-regulated use.",
     "source": "https://langfuse.com/security/hipaa",
     "checked": "2026-10-21"
    },
    "self_host": {
     "value": "yes (open source)",
     "detail": "",
     "quote": "Langfuse is open source and can be self-hosted using Docker on your own infrastructure.",
     "source": "https://langfuse.com/self-hosting",
     "checked": "2026-10-21"
    }
   }
  },
  {
   "slug": "langsmith",
   "name": "LangSmith",
   "category": "Eval & monitoring",
   "vendor": "LangChain",
   "region_filter": "apac",
   "notes": "",
   "fields": {
    "trains_by_default": {
     "value": "no",
     "detail": "",
     "quote": "We will not train on your data, and you own all rights to your data.",
     "source": "https://www.langchain.com/langsmith/observability",
     "checked": "2026-10-21"
    },
    "retention": {
     "value": "14 days (base) / 180 days (extended)",
     "detail": "From Sep 14, 2026, max extended retention for SaaS drops to 180 days (new traces only).",
     "quote": "Starting September 14, 2026, the maximum long-lived trace retention period for SaaS customers is changing to 180 days.",
     "source": "https://docs.smith.langchain.com/administration/concepts",
     "checked": "2026-10-21"
    },
    "zdr": {
     "value": "n/a",
     "detail": "Observability product; storing traces is the point.",
     "quote": "",
     "source": "https://docs.smith.langchain.com/administration/concepts",
     "checked": "2026-10-21"
    },
    "abuse_monitoring": {
     "value": "n/a",
     "detail": "Not applicable to an observability store.",
     "quote": "",
     "source": "https://docs.langchain.com/langsmith/regions-faq",
     "checked": "2026-10-21"
    },
    "residency": {
     "value": "US, EU, APAC (Sydney)",
     "detail": "GCP US (Iowa), GCP EU (Netherlands), AWS US (Ohio), GCP APAC (Sydney, from May 2026). No Singapore region.",
     "quote": "As of May 2026, LangSmith SaaS is available in APAC on GCP in",
     "source": "https://docs.langchain.com/langsmith/cloud",
     "checked": "2026-10-21"
    },
    "certifications": {
     "value": "SOC 2 Type 2",
     "detail": "ISO 27001 not stated on the page checked.",
     "quote": "We are also SOC 2 Type 2 certified and are HIPAA compliant.",
     "source": "https://docs.langchain.com/langsmith/regions-faq",
     "checked": "2026-10-21"
    },
    "hipaa_baa": {
     "value": "unverified",
     "detail": "LangChain says LangSmith is 'HIPAA compliant' and SOC 2 Type 2 certified, but no BAA offer is stated on the official pages read.",
     "quote": "",
     "source": "https://docs.langchain.com/langsmith/regions-faq",
     "checked": "2026-10-21"
    },
    "self_host": {
     "value": "yes (Enterprise add-on)",
     "detail": "",
     "quote": "Self-hosted LangSmith is an add-on to the Enterprise plan",
     "source": "https://docs.langchain.com/langsmith/self-hosted",
     "checked": "2026-10-21"
    }
   }
  },
  {
   "slug": "braintrust",
   "name": "Braintrust",
   "category": "Eval & monitoring",
   "vendor": "Braintrust",
   "region_filter": "none",
   "notes": "",
   "fields": {
    "trains_by_default": {
     "value": "no",
     "detail": "Stated in the self-serve MSA. A Braintrust blog post says the same for its Loop assistant.",
     "quote": "Braintrust agrees that it will not use any Customer Data to train, develop, or improve artificial intelligence or machine learning models, algorithms, or systems.",
     "source": "https://www.braintrust.dev/legal/msa",
     "checked": "2026-10-21"
    },
    "retention": {
     "value": "configurable",
     "detail": "Automated retention policies per object type. Self-hosted v1.1.21+ soft-deletes with a 24-hour grace period.",
     "quote": "automated retention policies",
     "source": "https://www.braintrust.dev/docs/security",
     "checked": "2026-10-21"
    },
    "zdr": {
     "value": "n/a (built-in model endpoints are ZDR)",
     "detail": "Traces are stored by design. The Braintrust-served model endpoints used for summarisation run with ZDR by default.",
     "quote": "ZDR is on by default and requires no configuration, so inference inputs and outputs are not stored by the model host.",
     "source": "https://www.braintrust.dev/docs/security",
     "checked": "2026-10-21"
    },
    "abuse_monitoring": {
     "value": "n/a",
     "detail": "Not applicable to an observability store.",
     "quote": "",
     "source": "https://www.braintrust.dev/docs/security",
     "checked": "2026-10-21"
    },
    "residency": {
     "value": "US or EU (Pro); self-host for others",
     "detail": "Pro customers choose a US or EU data plane; control-plane metadata may go to the US. No APAC region; self-hosting or BYOC is the route for other locations.",
     "quote": "Pro Plan Customers may elect to store the Data Plane in the US or the EU.",
     "source": "https://www.braintrust.dev/legal/dpa",
     "checked": "2026-10-21"
    },
    "certifications": {
     "value": "SOC 2 Type II",
     "detail": "",
     "quote": "Braintrust is SOC 2 Type II compliant.",
     "source": "https://www.braintrust.dev/docs/security",
     "checked": "2026-10-21"
    },
    "hipaa_baa": {
     "value": "yes",
     "detail": "",
     "quote": "For organizations subject to HIPAA regulations, Braintrust can execute Business Associate Agreements (BAAs).",
     "source": "https://www.braintrust.dev/docs/security",
     "checked": "2026-10-21"
    },
    "self_host": {
     "value": "yes (self-host or BYOC)",
     "detail": "",
     "quote": "With self-hosting , your team operates it.",
     "source": "https://www.braintrust.dev/docs/security",
     "checked": "2026-10-21"
    }
   }
  },
  {
   "slug": "arize",
   "name": "Arize (AX / Phoenix)",
   "category": "Eval & monitoring",
   "vendor": "Arize AI",
   "region_filter": "unverified",
   "notes": "",
   "fields": {
    "trains_by_default": {
     "value": "unverified",
     "detail": "The privacy policy says inputs to Arize's AI features (e.g. the Alyx assistant) are not used for training without consent. No statement covers trace data in general.",
     "quote": "",
     "source": "https://arize.com/privacy-policy/",
     "checked": "2026-10-21"
    },
    "retention": {
     "value": "15 days (Free) / 30 days (Pro) / custom",
     "detail": "AX trace retention by plan. Self-hosted Phoenix retention is set by you.",
     "quote": "Retention 15 days",
     "source": "https://arize.com/pricing/",
     "checked": "2026-10-21"
    },
    "zdr": {
     "value": "n/a",
     "detail": "Observability product; storing traces is the point.",
     "quote": "",
     "source": "https://arize.com/trust-center/",
     "checked": "2026-10-21"
    },
    "abuse_monitoring": {
     "value": "n/a",
     "detail": "Not applicable to an observability store.",
     "quote": "",
     "source": "https://arize.com/trust-center/",
     "checked": "2026-10-21"
    },
    "residency": {
     "value": "EU data residency offered",
     "detail": "Trust center links an announcement of EU data residency support. Full region list (and any APAC option) not verified.",
     "quote": "Arize AI: Support for EU Data Residency",
     "source": "https://arize.com/trust-center/",
     "checked": "2026-10-21"
    },
    "certifications": {
     "value": "SOC 2; ISO 27001; PCI DSS",
     "detail": "Trust center badges; a SOC 2 Type II announcement is linked.",
     "quote": "ISO/IEC 27001 Certified",
     "source": "https://arize.com/trust-center/",
     "checked": "2026-10-21"
    },
    "hipaa_baa": {
     "value": "unverified",
     "detail": "Trust center shows a 'HIPAA Compliant' badge; BAA availability not stated.",
     "quote": "",
     "source": "https://arize.com/trust-center/",
     "checked": "2026-10-21"
    },
    "self_host": {
     "value": "yes (Phoenix, free)",
     "detail": "Phoenix is free to self-host, can be fully air-gapped.",
     "quote": "Your data stays entirely within your infrastructure—nothing is sent to Arize and can be fully air-gapped.",
     "source": "https://arize.com/docs/phoenix/self-hosting",
     "checked": "2026-10-21"
    }
   }
  },
  {
   "slug": "helicone",
   "name": "Helicone",
   "category": "Eval & monitoring",
   "vendor": "Helicone",
   "region_filter": "none",
   "notes": "At check time the Helicone pricing page carried the banner \"Helicone is no longer part of Mintlify. Details to come soon.\" Source: https://www.helicone.ai/pricing (checked 2026-10-21).",
   "fields": {
    "trains_by_default": {
     "value": "unverified",
     "detail": "No training statement found on the pages checked.",
     "quote": "",
     "source": "https://docs.helicone.ai/references/data-autonomy",
     "checked": "2026-10-21"
    },
    "retention": {
     "value": "7 days / 1 month / 3 months / forever by plan",
     "detail": "Hobby 7 days, Pro 1 month, Team 3 months, Enterprise forever with configurable retention. Omit Logs keeps bodies out of long-term storage.",
     "quote": "Retention 7 days 1 month 3 months Forever",
     "source": "https://www.helicone.ai/pricing",
     "checked": "2026-10-21"
    },
    "zdr": {
     "value": "partial (Omit Logs)",
     "detail": "'Omit Logs' prevents storing request/response bodies; async logging captures metadata only.",
     "quote": "Use our Omit Logs feature to prevent storing request and response bodies in long-term storage.",
     "source": "https://docs.helicone.ai/faq/compliance",
     "checked": "2026-10-21"
    },
    "abuse_monitoring": {
     "value": "n/a",
     "detail": "Not applicable to an observability store.",
     "quote": "",
     "source": "https://docs.helicone.ai/references/data-autonomy",
     "checked": "2026-10-21"
    },
    "residency": {
     "value": "US or EU",
     "detail": "",
     "quote": "Choose between EU and US regions to meet your data residency and compliance requirements.",
     "source": "https://docs.helicone.ai/references/data-autonomy",
     "checked": "2026-10-21"
    },
    "certifications": {
     "value": "SOC 2 (Type II per pricing page)",
     "detail": "",
     "quote": "Our cloud infrastructure adheres to SOC2 standards",
     "source": "https://docs.helicone.ai/references/data-autonomy",
     "checked": "2026-10-21"
    },
    "hipaa_baa": {
     "value": "unverified",
     "detail": "The pricing page lists 'SOC-2 & HIPAA compliance' on the Team plan, but no BAA is stated on official Helicone pages read (docs.helicone.ai security page returns 404).",
     "quote": "",
     "source": "https://www.helicone.ai/pricing",
     "checked": "2026-10-21"
    },
    "self_host": {
     "value": "yes (open source)",
     "detail": "Docker Compose, Kubernetes, manual or cloud deployment.",
     "quote": "Deploy your own instance of Helicone using your preferred method.",
     "source": "https://docs.helicone.ai/getting-started/self-host/overview",
     "checked": "2026-10-21"
    }
   }
  }
 ]
}