AI gateway for banks and financial services, built for third-party risk review
Standard Compute is the AI gateway banks, fintechs and investment firms use to give staff and applications frontier and open models with the controls a DORA and EBA outsourcing review looks for. Through one API, each step goes to the cheapest model that can do it.
Risk, compliance and IT get one documented supplier: a Europe rule, zero data retention, approved providers only, a 12-month request log, a public sub-processor list and a DPA you sign in the dashboard.
Create a company accountor write to contact@standardcompute.com
The short answers
- What does a bank's ICT third-party review need from an AI gateway?
- Where data is processed, who processes it, what is retained, how access is controlled and what is logged. Standard Compute answers each with a control: a Europe rule, a published sub-processor list, zero data retention, Entra SSO, provider allow-lists and a 12-month request log.
- Can we stop AI traffic from reaching unapproved providers?
- Yes. Provider allow-lists fail closed: a model whose providers are not on the list is refused before anything is sent, new providers never join without an admin's approval, and fallbacks can never route around the list.
- Can staff use Claude Desktop and Claude Code with their work account?
- Yes. Employees sign in to Claude Desktop and Claude Code with their Microsoft work account, through our EU gateway, so there are no API keys to hand out. Access follows your Microsoft Entra groups through SCIM provisioning.
Your requirements, mapped to product controls
The questions in a DORA register entry or an EBA outsourcing assessment, and the product control that answers each one.
| What the sector asks for | How Standard Compute handles it |
|---|---|
| Data location for the ICT third-party register | Set a Europe rule for the company, a team or a single key. Every request, including retries and fallbacks, is served only by approved European inference endpoints, and a request no European endpoint can serve is refused before the prompt is sent. Account and usage records are stored in Frankfurt and the EU gateway runs in Finland. Request records hold metadata only (model, provider, tokens, cost and status), never prompts or outputs. |
| Subcontractors known in advance, changes notified | Sign the DPA in the dashboard in minutes: no training on your data, no retention of your content, breach notification within 72 hours. Every sub-processor is published, with 14 days' notice before a new one is added. |
| Customer data not retained or reused by providers | Turn on zero data retention and every request is routed only to inference endpoints that commit to keeping no copy of your data. We process prompts in memory and never write them to storage or logs. Standard Compute never trains on your prompts or outputs. |
| Concentration and provider risk under control | Choose exactly which inference providers may handle your data, for the company, a team or a key. Lower levels can only narrow the list, new providers never join without an admin's approval, and fallbacks never route around it. |
| Access management tied to the bank's identity provider | Connect Microsoft Entra ID or any SAML identity provider. Anyone on your verified domain joins the company automatically, and access to Claude Desktop and Claude Code follows your Entra groups through SCIM. |
| Audit trail for the second and third line | Every admin change is recorded with before and after values. Export a record of every request showing the model, the provider that served it and the region rule in force, kept for 12 months. |
| Service continuity | If a provider goes down, the request fails over to another approved provider of the same model without leaving your region or provider rules. Enterprise includes a 99.9% monthly uptime SLA with service credits. |
| Approved use cases only | Decide which models each key can use, so every app and every person gets exactly the models you approve. GLM, DeepSeek and MiniMax run on European providers for Europe-restricted workspaces. |
| Cost control per desk and per application | Every person and app gets a fixed monthly budget that never overruns, with spending caps per key and for the whole company. |
Set it up in an afternoon
Create the company account
Invite colleagues by email, organize them into teams, and give every person and every app its own key.
Set the Europe rule and zero data retention
Set both for the whole company. Teams and keys inherit them and can never switch them off underneath you.
Connect Microsoft Entra ID
People sign in with their work accounts, and employees use Claude Desktop and Claude Code with their Microsoft work account through our EU gateway.
Approve providers and models, then sign the DPA
Choose which inference providers and models each key may use, set the budgets, and sign the DPA in the dashboard.
Regulation references
The rules buyers in this sector check first, linked to the official text. They are references for your own assessment.
Links checked 9 November 2026.
Questions from IT, security and procurement
- Is there a request-level record for supervisors and internal audit?
- Yes. Export a record of every request showing the model, the provider that served it and the region rule in force, kept for 12 months. Request records hold metadata only, never prompts or outputs.
- Do you publish your sub-processors?
- Yes. We publish every sub-processor with its purpose, data and location, and give you 14 days' notice before adding a new one.
- Can different teams use different models?
- Yes. Decide which models each key can use, so every application and every person gets exactly the models you approve. Rules set for the company can only be narrowed by teams and keys.
- Is there an uptime commitment?
- Enterprise includes a 99.9% monthly uptime SLA with service credits, and requests fail over between approved providers of the same model inside your rules.
Read next
Other sectors
Create the company account, set the Europe rule and zero data retention, and your people can start the same day.