Tools · Privacy-First AI API Selector
Which AI APIs don't train on your data?
Filter API providers by the privacy terms that actually matter for GDPR and CCPA — no training, signable DPA, zero retention, EU residency, deletion on request. Verified from provider docs.
Filter by privacy requirement
8 of 8 API providers match
Anthropic (Claude API)
Claude models via the Anthropic API. Used widely for enterprise reasoning and coding tasks.
- No training (default or opt-out)
- Yes
- DPA
- Yes
- Zero retention
- Yes
- EU residency
- No
- Delete on request
- Yes
- Retention
- 30 days
API inputs and outputs deleted within 30 days by default; zero data retention by agreement, except for Covered Models (Claude Mythos 5 and 5.1, Claude Fable 5 and 5.1), which require 30-day retention. BAA available for HIPAA-ready services, including the first-party API. ISO 27001:2022 and SOC 2 Type II.
AWS Bedrock
Access to multiple foundation models (Claude, Titan, Mistral, Llama) via AWS with enterprise security controls.
- No training (default or opt-out)
- Yes
- DPA
- Yes
- Zero retention
- Yes
- EU residency
- Yes
- Delete on request
- Yes
- Retention
- Unknown
Content not used to improve base models and not shared with model providers; stored in the Region you use. Retention depends on the model unless you turn on ZDR mode. Bedrock is a HIPAA-eligible service.
Microsoft Azure OpenAI
OpenAI models hosted on Microsoft Azure with enterprise data controls. Best for orgs already in Azure.
- No training (default or opt-out)
- Yes
- DPA
- Yes
- Zero retention
- Yes
- EU residency
- Yes
- Delete on request
- Yes
- Retention
- Unknown
Prompts and completions not available to OpenAI and not used to train foundation models. Models are stateless; optional stateful features store data as you configure. Customers approved for modified abuse monitoring get no prompt storage or human review; automated checks still run. EU DataZone keeps processing in the EU. SOC 2, ISO and HIPAA scope is listed in Microsoft's Service Trust Portal, which we could not open.
Cohere
Enterprise-focused embeddings and generation models. Strong on retrieval and RAG use cases.
- No training (default or opt-out)
- Yes
- DPA
- Yes
- Zero retention
- Yes
- EU residency
- Unknown
- Delete on request
- Yes
- Retention
- 30 days
SaaS prompts and generations deleted after 30 days; zero data retention for approved customers. Prompts and generations can train Cohere models until you opt out in Data Controls. DPA on request from [email protected] for SaaS customers. BAA only for custom model development engagements. Private on-prem or VPC deployments available.
DeepSeek (API)
DeepSeek models via the DeepSeek Open Platform API, run by Hangzhou DeepSeek Artificial Intelligence Co., Ltd. in China.
- No training (default or opt-out)
- Unknown
- DPA
- Unknown
- Zero retention
- Unknown
- EU residency
- No
- Delete on request
- Yes
- Retention
- Unknown
Personal data is collected, processed and stored in China. No DPA or subprocessor list published. Terms allow use of de-identified inputs and outputs to improve the service unless Improve the model for everyone is off; the API docs don't say that setting covers API accounts. Weights for models such as DeepSeek-V4.1-Flash are MIT-licensed and can be self-hosted.
Google (Gemini API)
Gemini models via the Gemini API (AI Studio) or Google Cloud's Gemini Enterprise Agent Platform (formerly Vertex AI).
- No training (default or opt-out)
- Yes
- DPA
- Yes
- Zero retention
- Yes
- EU residency
- Yes
- Delete on request
- Yes
- Retention
- Unknown
Updated Oct 24, 2026: Google now documents Vertex AI as Gemini Enterprise Agent Platform, with in-memory and durable caching on by default. On Google Cloud: no training without permission, cached data deleted within 24 hours and caching can be turned off, and prompts may be logged for abuse detection. SOC 2, HIPAA and ISO 27001 cover the Agent Platform. The unpaid Gemini API can use data to improve Google products, except for users in the EEA, Switzerland and the UK.
Mistral AI (API)
European-built foundation models via API. Strong EU data residency story as a French company.
- No training (default or opt-out)
- Yes
- DPA
- Yes
- Zero retention
- Yes
- EU residency
- Yes
- Delete on request
- Yes
- Retention
- 30 days
Data hosted in the EU by default. Studio and API data, including Free mode, can be used for training until an admin turns off Anonymous improvement data in the Admin panel. ZDR only on pay-as-you-go stateless API calls. SOC 2 Type II and ISO 27001. Models can be self-deployed. HIPAA BAA offered for qualifying services (Trust Center).
OpenAI (API)
GPT models via the OpenAI API Platform. The most widely deployed foundation model provider.
- No training (default or opt-out)
- Yes
- DPA
- Yes
- Zero retention
- Yes
- EU residency
- Yes
- Delete on request
- Yes
- Retention
- 30 days
API data not used for training by default. Abuse monitoring logs kept up to 30 days; zero data retention or Modified Abuse Monitoring for customers OpenAI approves. HIPAA BAA available for the API with Modified Retention. EU data residency via eu.api.openai.com; processing in Europe needs one of those approved retention controls.
Get notified when a provider changes its data policy
We re-verify every provider's training, retention, and DPA terms and flag changes. Free, small-team focused.
Choosing an AI API that respects data privacy
The single most important distinction is between an API and a consumer app. A developer calling the OpenAI or Anthropic API is in a different privacy position than an employee typing into ChatGPT or Claude.ai in a browser tab. OpenAI has not trained on API data by default since March 1, 2023, and Anthropic, Azure, AWS Bedrock and Google Cloud say the same for their APIs. Consumer products often do train unless you opt out.
For GDPR or CCPA compliance, three terms matter most: whether the provider trains on your data, whether a signable Data Processing Agreement is available, and whether you can configure zero data retention for sensitive inputs. The selector above filters live, verified data on each of these so you can shortlist providers in seconds rather than reading a dozen privacy policies.
For the full explanation of each term, the three contract clauses to insist on, and provider-by-provider detail, read the privacy-first AI API guide.