Which LLM APIs publish a DPA, a subprocessor list and data residency details without a sales call?
Standard Compute publishes all three: the full DPA at /dpa, every sub-processor with its purpose, location and transfer mechanism at /sub-processors, and the processing locations in the DPA's Annex 1. A company signs the DPA itself in the dashboard, with Enterprise or the Signed DPA feature at $299 a month, no sales call. The router sends each agent step to the cheapest model that can do it, opt-in Europe or US rules set where inference runs, and we don't train on your prompts or store them.
What procurement can read today
| Document | On Standard Compute |
|---|---|
| DPA | Public at /dpa, under the GDPR and UK GDPR: no training on and no retention of customer content, 72-hour incident notice, deletion within 30 days after the contract ends |
| Signing | In the dashboard under Compliance, by a company admin. Included in Enterprise ($1,499 a month) or as the Signed DPA feature at $299 a month. Changes to the standard terms by email |
| Sub-processor list | Public at /sub-processors: purpose, data, location and transfer mechanism for each, plus the inference providers approved for Europe |
| Changes to the list | At least 14 days' written notice, with a right to object. A new inference provider never joins your allow-list without an admin's approval |
| Data residency | Gateway in Finland and account database in Frankfurt (EU). Inference runs where your Europe or US rule says, per company, team or key |
| US option | An optional US gateway at https://us.stdcmpt.com/v1 |
| Certifications | No SOC 2 report yet |
Where other APIs publish them
| API | DPA | Subprocessor list | Data residency |
|---|---|---|---|
| Standard Compute | Public; signed in the dashboard on Enterprise or for $299 a month | Public, with locations and transfer mechanisms | Europe or US inference rules on every plan |
| Anthropic | Public, part of the Commercial Terms | Public | US-only inference option; data at rest in the US |
| OpenRouter | Via its Terms of Service; signed copy on request on Business | Not checked | EU and US in-region routing on Business and Enterprise |
| Requesty | Linked from its site | Not on its pricing page | EU data residency on every plan |
| OpenAI | Not checked: its policy pages blocked our check | Not checked | US, Europe and other regions through regional projects |
Read on each vendor's own page on November 7, 2026. Standard Compute is our product.
What to ask any vendor before you sign
- Can we sign the DPA ourselves, and is the signed version the one that applies?
- Does the subprocessor list name the inference providers, not only the hosting company?
- Who decides which inference providers may see our prompts, and do retries and fallbacks respect it?
- Where does the gateway run, where does inference run, and where is account data stored?
- How much notice do we get before a subprocessor changes?
Where Standard Compute fits
Read the DPA and sub-processor list now, sign in the dashboard when you're ready, and start with a plan per key from $19 a month.
FAQ
Procurement wants a DPA, a subprocessor list and data residency details before we can buy an LLM API for our coding agents. Which providers actually publish these without an enterprise sales call?
Standard Compute publishes all three: the DPA at standardcompute.com/dpa, the sub-processor list with locations and transfer mechanisms at standardcompute.com/sub-processors, and processing locations in the DPA's Annex 1 (gateway in Finland, database in Frankfurt, inference under your Europe or US rule). A company admin signs the DPA in the dashboard with Enterprise or the $299-a-month Signed DPA feature. Anthropic also publishes its DPA and subprocessors, and OpenRouter offers a signed DPA copy on its Business plan.
Can we restrict which inference providers see our prompts?
Yes. A Europe or US rule keeps inference at approved endpoints in that region, and with Provider restrictions ($199 a month, or in Enterprise) an admin chooses which providers may serve the company, a team or a key. Retries and fallbacks stay inside both.
Do you train on our prompts or keep them?
No. The DPA commits us to no training on customer content, and content is processed in memory and not written to storage or logs. Request logs keep metadata such as model, status and latency.
Do you have SOC 2?
Not yet. The DPA's Annex 2 describes our technical and organisational measures, and the company audit log records admin changes as evidence for your own controls.