Which LLM API can a UK company use for coding agents under UK GDPR?
Standard Compute is one OpenAI- and Anthropic-compatible API that sends each agent step to the cheapest model that can do it, through providers vetted for price, uptime and speed, with automatic fallback. For UK GDPR, a Europe rule on your company, team or key keeps inference at provider endpoints in the EU, which UK adequacy regulations cover. There is no UK region, requests pass through OpenRouter in the US on the way, and we don't train on your prompts or store them.
Cost control first, also under a Europe rule
- With model
standardcompute, the router sends each step to the cheapest capable model. Under a Europe rule it chooses among the models with a European endpoint, and the classifier that picks also runs in Europe. - Providers are vetted per model for price, uptime and speed. When one fails, the request moves to another European endpoint of the same model, never to another model or out of Europe.
- Plans start at $19 a month per person, and business plans at $499. Prices and card charges are in USD, and the rule doesn't change the price.
- European endpoints can cost more than the cheapest global provider, so the same monthly budget can run out sooner.
Where each part of a request runs
| Part | Where | Under UK GDPR |
|---|---|---|
| Inference, with a Europe rule | Approved EU endpoints across 13 models, such as Google Vertex AI in Europe, Amazon Bedrock in Ireland and Azure's EU Data Zone | The EEA is covered by UK adequacy regulations (ICO) |
| Inference, with no rule | Any provider in the catalogue, including the US | The US is covered only for organisations certified under the UK Extension to the EU-US Data Privacy Framework (ICO) |
| Routing layer | OpenRouter, Inc., New York (terms). Every request passes through it, and it can process requests outside the EU | A US recipient, so include it in your transfer assessment |
| Our gateway | Google Cloud in Finland, at api.stdcmpt.com. The optional us.stdcmpt.com endpoint runs in the US, so keep the default | In the EEA |
| Prompts and responses | Not stored or logged by us, and not used for training. Under a rule, providers must also offer zero data retention and no training | Still sent to OpenRouter and the provider, as in the rows above |
| Account data | Supabase on AWS eu-central-1 (Frankfurt): email, encrypted API keys, plan and usage counters | In the EEA |
| The company | Standard Compute AS, Oslo. Norwegian law, courts of Oslo | Norway is in the EEA |
Endpoints from the list the gateway enforces, reviewed 2026-10-13. Sub-processors and retention on data and privacy.
Is the UK part of the Europe rule?
No. Compliance has two regions, Europe and the United States, and Europe means approved endpoints in the EU, plus Inceptron, which states that it processes everything in the EU/EEA. None of the endpoints a restricted key can reach is in the UK, so a Europe-only key sends inference from the UK to the EU.
If a contract requires inference inside the UK, we don't fit. A direct contract with a cloud provider that offers your model in a UK region does.
Which models run in Europe, how to set the rule and what a restricted request may not do are on the EU LLM API page. The rule is set once per company and narrowed per team or key.
UK GDPR transfer rules that apply
| Question | Answer |
|---|---|
| Is it a restricted transfer? | Yes, if UK GDPR applies to the data, you start the transfer, and the receiver outside the UK is a separate legal entity: the ICO's three-step test (ICO) |
| UK to the EEA | Covered by UK adequacy regulations, which include every EEA country, Norway among them (ICO) |
| UK to the US | Covered only when the receiver is certified under the UK Extension to the EU-US Data Privacy Framework, in effect since October 12, 2023 (ICO) |
| Anywhere else | A safeguard such as the ICO's international data transfer agreement (IDTA) or its Addendum to the EU standard contractual clauses, with a transfer risk assessment (ICO) |
| EEA to the UK | The European Commission renewed its UK adequacy decision on December 19, 2025, for six years, to December 27, 2031 (European Commission, adequacy list) |
Read on ico.org.uk and the European Commission's site on October 15, 2026. A summary for procurement, not legal advice.
Gaps to check before procurement
- No standard DPA is published. Ask contact@standardcompute.com if procurement needs a signed agreement.
- No SOC 2 report or ISO 27001 certification, and no SSO, SAML or SCIM.
- This is a provider inference location control, not end-to-end residency. End-to-end zero data retention across the routing layer has not been confirmed.
- Claude Fable and GPT-6 Astra have no European endpoint, so a Europe-only key can't use them.
- No billing in pounds. Company checkout asks for a billing address and takes a VAT number, and invoices are emailed monthly with a PDF.
Where Standard Compute fits
Create a company, set Compliance to Europe once, and every key your team creates follows it. Claude Code, Codex CLI, OpenCode and other agents keep the base URL https://api.stdcmpt.com/v1.
FAQ
Does Standard Compute offer UK data residency?
No. There is no UK region. With a Europe rule, inference runs at EU provider endpoints, and our company, gateway and account database are in the EEA. Requests also pass through OpenRouter, a US company.
Do I need an IDTA to use Standard Compute from the UK?
Not for the parts in the EEA: our company, gateway, account database and Europe-rule inference, which UK adequacy regulations cover. OpenRouter, in the request path, is in the US, and keys without a rule can reach providers anywhere. We don't publish a DPA, so ask contact@standardcompute.com what covers those transfers and check it with your DPO.
Is Standard Compute UK GDPR compliant?
No API can make your processing compliant for you. What we can show: account data in Frankfurt, no storage of prompts or responses, no training on them, Norwegian law inside the EEA, a public sub-processor list, and Europe rules that require zero data retention at the provider.
Can Claude Code use a Europe-only key from the UK?
Yes. Set ANTHROPIC_BASE_URL to https://api.stdcmpt.com, use the restricted key, and set ANTHROPIC_MODEL and every ANTHROPIC_DEFAULT_*_MODEL slot to catalog IDs such as anthropic/claude-sonnet-5.5. Claude Opus 5.5, Sonnet 5.5 and Haiku 5.5 run on Google Vertex AI in Europe, and Opus also on Amazon Bedrock in Ireland.
Can you invoice in pounds?
No. Plans are priced and charged in USD, so your bank sets the rate. Company invoices carry your company name, address and VAT number.