Security review pack
Everything a security or procurement reviewer needs to assess Standard Compute, on one page: what data we process and where, retention, training, sub-processors, the DPA, sign-in, access control, logs and breach notification. It answers the questions in a standard vendor security questionnaire, with references to our DPA.
Updated 7 November 2026
Create a company workspaceor send your questionnaire to contact@standardcompute.com
The short answers
- What data does Standard Compute process?
- We process your prompts in memory to serve each request and never write them to storage or logs. Request records hold metadata only (model, provider, tokens, cost and status), never your prompts or outputs.
- Where is it processed?
- With a Europe rule, every request, including retries and fallbacks, is served only by approved European inference endpoints. Our EU gateway terminates TLS and runs in Finland, and your account data is stored in Frankfurt.
- Is customer data used for training?
- Standard Compute never trains on your prompts or outputs. With a region rule or zero retention turned on, every request goes only to providers that commit not to train on it.
- Is there a DPA?
- Sign our Data Processing Agreement in the dashboard in minutes. It commits us to no training on your data, no retention of your content, and breach notification within 72 hours.
- Who is the contracting entity?
- Standard Compute AS, a Norwegian private limited company (org. no. 938 498 806), registered in Oslo, Norway.
What we process, where, and for how long
| Data | What it contains | Where | Retention |
|---|---|---|---|
| Prompts and outputs | The content your people and applications send and receive | Where: With a Europe rule: approved European inference endpoints only, through our EU gateway in Finland | Retention: Processed in memory to serve the request, never written to storage or logs |
| Request records | Time, key, model, serving provider, tokens, cost and status. No content | Where: Frankfurt, Germany | Retention: Request audit export kept for 12 months on Enterprise and the SLA add-on |
| Account data | Company, people, teams, keys, budgets and settings | Where: Frankfurt, Germany | Retention: Deleted or returned within 30 days of termination (DPA section 10) |
Controls and commitments
Retention and training
Turn on zero data retention for your company, a team or a key, and every request is routed only to inference endpoints that commit to keeping no copy of your data. Teams and keys inherit the requirement and can never switch it off underneath you.
Standard Compute never trains on your prompts or outputs. With a region rule or zero retention turned on, every request goes only to providers that commit not to train on it.
Processing in Europe
Set a Europe rule for your company, a team or a single key, and every request, including retries and fallbacks, is served only by approved European inference endpoints. If no European endpoint can serve it, the request is refused before your prompt is sent.
Our EU gateway terminates TLS and runs in Finland, and your account data is stored in Frankfurt.
Sub-processors
We publish every sub‑processor with its purpose, data and location, and give you 14 days’ notice before adding a new one.
Data Processing Agreement
Sign our Data Processing Agreement in the dashboard in minutes. It commits us to no training on your data, no retention of your content, and breach notification within 72 hours.
Transfers outside the EEA or the UK to a country without an adequacy decision are governed by the EU Standard Contractual Clauses and the UK International Data Transfer Addendum (section 6). You may audit us once in any 12-month period (section 9), and on termination we delete or return your personal data within 30 days (section 10). The DPA is governed by Norwegian law, and the full text is public so legal can read it before you sign.
Single sign-on and access control
Connect Microsoft Entra ID or any SAML identity provider so your people sign in to Standard Compute with their work accounts. Anyone on your verified domain joins your company automatically.
Employees sign in to Claude Desktop and Claude Code with their Microsoft work account, through our EU gateway, so there are no API keys to hand out. Access follows your Microsoft Entra groups through SCIM provisioning.
People are admins or members, and every person and every app gets its own key. Choose exactly which inference providers may handle your data, for the whole company, a team or a single key. Lower levels can only narrow the rules, new providers are never added without an admin’s approval, and fallbacks can never route around your list. Decide which models each key can use.
Audit and request logs
Every admin change is recorded with before and after values, and you can export a record of every request showing the model, the provider that served it and the region rule in force, kept for 12 months.
Incidents, breach notification and availability
Under the DPA (section 7) we notify you of a personal data breach within 72 hours.
If a provider goes down, your request fails over to another approved provider of the same model automatically, without leaving your region or provider rules. Enterprise includes a 99.9% monthly uptime SLA with service credits.
Vendor security questionnaire, pre-answered
The questions reviewers ask most often, with the answer we give. For anything not covered here, send your own questionnaire and we return it completed.
Company and data
| Question | Answer |
|---|---|
| Legal entity and jurisdiction | Standard Compute AS, a Norwegian private limited company, org. no. 938 498 806, registered in Oslo. |
| Do you store prompts or outputs? | No. We process prompts in memory to serve each request and never write them to storage or logs. |
| Do you train models on customer data? | No. Standard Compute never trains on your prompts or outputs. |
| Do your inference providers train on our data? | With a region rule or zero retention turned on, every request goes only to providers that commit not to train on it. |
| Can processing be restricted to Europe? | Yes. A Europe rule on the company, a team or a key limits every request, retry and fallback to approved European inference endpoints. |
| What happens if no European endpoint is available? | The request is refused before your prompt is sent. |
| Where is the gateway hosted? | Our EU gateway terminates TLS and runs in Finland. |
| Where is account and usage data stored? | Frankfurt, Germany. |
| What do request logs contain? | Metadata only: model, provider, tokens, cost and status. Never prompts or outputs. |
| Do you offer zero data retention? | Yes. Set it for the company, a team or a key, and requests go only to endpoints that commit to keeping no copy of your data. |
| Can a team or key switch off zero retention? | No. Teams and keys inherit the requirement and can never switch it off. |
Sub-processors and DPA
| Question | Answer |
|---|---|
| Do you publish your sub‑processors? | Yes, at /sub-processors, with each one’s purpose, data and location. |
| Notice before a new sub‑processor? | 14 days. |
| Do you sign a DPA? | Yes. You sign it in the dashboard, and the full text is public at /dpa. |
| Breach notification timeframe | Within 72 hours, under the DPA (section 7). |
| International transfer mechanism | The EU Standard Contractual Clauses and the UK International Data Transfer Addendum (DPA section 6). |
| Governing law of the DPA | Norwegian law, with Oslo District Court as venue. |
| Customer audit rights | Once in any 12-month period, with 30 days’ written notice (DPA section 9). |
| Data deletion at termination | Personal data is deleted or returned within 30 days (DPA section 10). |
Identity and access
| Question | Answer |
|---|---|
| Single sign-on | Microsoft Entra ID or any SAML identity provider. |
| User provisioning | Anyone on your verified domain joins automatically. Claude Desktop and Claude Code access follows your Entra groups through SCIM. |
| Roles | Admin and member, with a separate key for every person and app. |
| Can we restrict which AI providers process our data? | Yes. A provider allow-list for the company, a team or a key; new providers need an admin’s approval and fallbacks can never route around it. |
| Can we restrict which models are used? | Yes. You decide which models each key can use. |
| Admin activity logging | Every admin change is recorded with before and after values. |
| Request-level audit trail | An exportable record of every request with the model, serving provider and region rule, kept for 12 months on Enterprise. |
Operations and billing
| Question | Answer |
|---|---|
| Spend controls | A fixed monthly budget per person or app that never overruns, plus spending caps per key and for the whole company. |
| Provider outage handling | Requests fail over to another approved provider of the same model without leaving your region or provider rules. |
| Uptime commitment | Enterprise includes a 99.9% monthly uptime SLA with service credits. |
| Invoicing | Stripe invoices with your company name and VAT number. |
Common questions from security and procurement
- What does a security reviewer need to assess Standard Compute?
- This page, the security overview at /security, the sub‑processor list at /sub-processors and the DPA at /dpa cover what we process, where, for how long, who else processes it and what we commit to.
- How do we sign the DPA?
- A company admin signs it in the Standard Compute dashboard in minutes, and the full text is public at /dpa beforehand.
- Where do we send our own security questionnaire?
- Send it to contact@standardcompute.com with the subject “Security review”, and we return it completed.
Related pages
Create your company workspace to sign the DPA, connect your identity provider and set your rules. For your own questionnaire, write to us with the subject “Security review”.