Is there a GDPR compliant LLM API?

GDPR compliance depends on how your company processes personal data, so no API can promise it for you. What you can require from the API is a signed DPA, no training on your data, no retention of your content and processing in Europe. Standard Compute offers all four, with the Europe rule and zero retention switched on for your company, a team or a key.

Does Standard Compute process prompts only in the EU?

With a Europe rule, your prompts are processed only in Europe. They enter and leave through our gateway in Finland and are served only by approved European inference endpoints, with no fallback outside Europe. Europe in this rule includes the UK and Switzerland.

Can we sign a DPA without a sales call?

Yes. A company admin signs our Data Processing Agreement in the dashboard, with Enterprise or the Signed DPA feature. It commits us to no training on your data, no retention of your content, and breach notification within 72 hours.

Which models can run under a Europe rule?

Claude Opus 5.5, Sonnet 5.5 and Haiku 5.5 on Vertex Europe and Bedrock Ireland, GPT models on Azure's EU endpoints, and open models such as GLM, DeepSeek and MiniMax from European providers. A model with no European endpoint is refused before anything is sent.

GDPR compliant LLM API: what to check before personal data goes into a prompt

No API can make your processing GDPR compliant for you, but it can give you the terms a GDPR review asks for. Standard Compute gives you a Data Processing Agreement you sign in the dashboard, no training on your prompts or outputs, no storage of your content, a public sub-processor list, and a Europe rule that keeps inference at approved European endpoints.

Set a Europe rule for your company, a team or a single key, and every request, including retries and fallbacks, is served only by approved European inference endpoints. If no European endpoint can serve it, the request is refused before your prompt is sent.

By Standard Compute · Last updated 9 November 2026

The GDPR questions, answered for Standard Compute

What a data protection officer or security reviewer asks about an LLM API, and the answer for Standard Compute.

The GDPR questions, answered for Standard Compute
Question	Standard Compute
Is there a DPA?	Standard Compute: Yes. Sign our Data Processing Agreement in the dashboard in minutes, with Enterprise or the Signed DPA feature. The text is public at /dpa
What does the DPA commit to?	Standard Compute: No training on your data, no retention of your content, and breach notification within 72 hours. Standard contractual clauses and the UK IDTA cover transfers, under Norwegian law
Are prompts used for training?	Standard Compute: Standard Compute never trains on your prompts or outputs. With a region rule or zero retention turned on, every request goes only to providers that commit not to train on it
Are prompts stored?	Standard Compute: We process your prompts in memory to serve each request and never write them to storage or logs
Zero data retention at the provider	Standard Compute: Turn it on for your company, a team or a key, and every request is routed only to inference endpoints that commit to keeping no copy of your data
Where inference runs	Standard Compute: With a Europe rule, only at approved European inference endpoints, with no fallback outside Europe. Europe here includes the UK and Switzerland
Where account data is kept	Standard Compute: Account and usage records are stored in Frankfurt, Germany, and our EU gateway runs in Finland. Request records hold metadata only, never prompts or outputs
Sub-processors	Standard Compute: We publish every sub-processor with its purpose, data and location, and give you 14 days' notice before adding a new one

The Europe rule and zero data retention are free and opt-in, per company, team or key. Our EU endpoint, https://eu.stdcmpt.com/v1, is available to every key.

Create a company workspaceSee pricing

LLM APIs compared on GDPR terms

The large model APIs differ most on three points: whether they train on API data, how long they keep it, and whether processing can be kept in Europe. Each row below comes from the vendor's own docs or terms, checked on 9 November 2026.

LLM APIs compared on GDPR terms
API	Training on API data	Retention	Processing in Europe
OpenAI API	Training on API data: "Not used to train or improve OpenAI models"	Retention: Abuse monitoring logs kept for up to 30 days by default; zero data retention needs OpenAI's approval	Processing in Europe: A Europe region for eligible projects, after approval for abuse monitoring controls and a Modified Retention amendment
Claude API (Anthropic)	Training on API data: "Anthropic may not train models on Customer Content from Services"	Retention: Prompts and outputs not retained by default, except for Covered Models; zero data retention through Anthropic's sales team	Processing in Europe: The inference_geo option offers only "us" and "global"
Azure OpenAI in Foundry	Training on API data: Not used by the providers of models sold by Azure to improve their models	Retention: Abuse monitoring applies; customers who meet Limited Access criteria can apply to modify it	Processing in Europe: EU Data Zone deployments: processing in EU member states, following the EU Data Boundary
Amazon Bedrock	Training on API data: AWS and third-party model providers "will not use any inputs to or outputs from Amazon Bedrock to train"	Retention: By default AWS may retain data for safety and abuse prevention; a zero retention mode can be set per Region or project	Processing in Europe: Geographic cross-region inference keeps processing within a geography such as the EU
Standard Compute	Training on API data: Never trains on prompts or outputs	Retention: Prompts processed in memory, never written to storage or logs; zero data retention required at the provider when switched on	Processing in Europe: A Europe rule per company, team or key: approved European endpoints only, through our EU gateway in Finland

Sources are listed at the end of this page. Standard Compute is our product.

What a GDPR review of an LLM API checks

Under Article 28 of the GDPR, a provider that processes personal data for you needs a processor contract. Ask for the DPA first, then check four things in it and in the provider's docs: whether prompts and outputs are used for training, how long they are kept and why, where inference and logs are processed, and which sub-processors are involved.

Transfers matter for routers and gateways in particular, because one request can pass through several companies. On Standard Compute, a Europe rule pins the classifier, the answer, retries and fallbacks to reviewed European endpoints, and provider allow-lists let an admin choose exactly which inference providers may handle your data.

Switch an application to a Europe-restricted key

Create a company, set Compliance to Europe once, and point your OpenAI-compatible client at the EU gateway. Your code stays the same.

OPENAI_BASE_URL=https://eu.stdcmpt.com/v1
OPENAI_API_KEY=<key-with-a-europe-rule>
MODEL=standardcompute

.env

Questions from IT, security and finance

Is there a GDPR compliant LLM API?: GDPR compliance depends on how your company processes personal data, so no API can promise it for you. What you can require from the API is a signed DPA, no training on your data, no retention of your content and processing in Europe. Standard Compute offers all four, with the Europe rule and zero retention switched on for your company, a team or a key.
Does Standard Compute process prompts only in the EU?: With a Europe rule, your prompts are processed only in Europe. They enter and leave through our gateway in Finland and are served only by approved European inference endpoints, with no fallback outside Europe. Europe in this rule includes the UK and Switzerland.
Can we sign a DPA without a sales call?: Yes. A company admin signs our Data Processing Agreement in the dashboard, with Enterprise or the Signed DPA feature. It commits us to no training on your data, no retention of your content, and breach notification within 72 hours.
Which models can run under a Europe rule?: Claude Opus 5.5, Sonnet 5.5 and Haiku 5.5 on Vertex Europe and Bedrock Ireland, GPT models on Azure's EU endpoints, and open models such as GLM, DeepSeek and MiniMax from European providers. A model with no European endpoint is refused before anything is sent.