wdmpgWhere Do My Prompts Go?
121 sources checked · 0 fetch errors last check data v2026-10-26 · sha256 00e98854 data.jsondata.csvllms.txt

service openroutervendor OpenRoutercategory Inference hosts & routers

Does OpenRouter train on your data?

Depends on provider (Caution)OpenRouter itself does not train on inputs. Underlying providers may; an account setting blocks routing to providers that train.

fields
3 favourable2 caution2 unverified1 neutral / n/a
sources cited
4 pages
source monitor
4/4 ok on 2026-10-26
last field check

Evidence log

8 entries · newest check 2026-10-21
WARN

Trains on your data by default

= depends on provider (Caution)

OpenRouter itself does not train on inputs. Underlying providers may; an account setting blocks routing to providers that train.

OpenRouter does not use your Inputs or Outputs for model training.

OK

Default retention

= not logged by default (Favourable)

OpenRouter says it does not log prompts by default (prompt logging is opt-in). Provider-side retention varies by provider and is shown per endpoint.

Prompts are not logged by default.

Against the 21 tools that state a period (grey dots):

01d7d30d90d1y∞
OK

Zero data retention

= yes (routing filter) (Favourable)

Can enforce ZDR-only routing globally, per model group, per guardrail or per request. Endpoints with unclear policies are assumed to retain and train.

If OpenRouter is not able to establish or ascertain a clear policy for a provider or endpoint, we take a conservative stance and assume that the endpoint both retains and trains on data and mark it as such.

WARN

Abuse-monitoring exception

= depends on provider (Caution)

Some providers that don't train still retain data for abuse scanning.

we do have some endpoints & providers who do not train on your data but do retain it (e.g. to scan for abuse or for legal reasons).

N/A

Data residency / regions

= EU or US (Business/Enterprise) (Neutral / n/a)

In-region routing via eu.openrouter.ai and us.openrouter.ai. No APAC option documented.

On the Business and Enterprise plans, OpenRouter supports in-region routing in the EU and US.

OK

SOC 2 / ISO 27001

= SOC 2 Type II (Favourable)

Stated on the enterprise page.

SOC 2 Type II. DPA with SCCs for GDPR programs.

UNVERIF

HIPAA BAA

= unverified (Unverified)

Not stated.

no official page stated this clearly

Source checks

4 pages

Spotted something wrong or out of date? Corrections are welcome; see how to send one. How statuses are assigned.

Weekly policy changes. Confirm by email. Unsubscribe anytime.

Powered by Buttondown