Where does this provider put your AI data — and who can compel its disclosure?
| Category | aggregator |
|---|---|
| Residency | Region-dependent — unresolved until an endpoint region is pinned |
| Sovereignty | Unknown unknown |
| Endpoints | openrouter.ai |
| Packages | @openrouter/ai-sdk-provider (npm) |
| KB note | multi-provider router; destination chosen at runtime. No official/de-facto JVM or .NET SDK — used via OpenAI SDKs with this base URL, which endpoint detection covers |
How does this provider treat the data you send it? Advisory statements about documented practices — not legal advice.
| Trains on customer API data by default | No source — 'Enterprise and API Users': 'OpenRouter does not use your Inputs or Outputs for model training'; same policy, 'Model Provider Data Practices': 'Some Model Providers may use your Inputs and Outputs for model training or improvement' (retrieved 2026-10-10) |
|---|---|
| Retention (API inputs/outputs) | OpenRouter itself has a zero-retention policy: prompts are not retained unless the user opts into prompt logging (DPA §2.4(a): inputs/outputs deleted 'promptly following generation of the relevant Output'); request metadata (timestamps, model, token counts) is kept for billing. Downstream model providers' retention varies per endpoint; users can enforce ZDR-only routing globally, per guardrail, or per request (provider.zdr). source — 'OpenRouter's Retention Policy': 'OpenRouter itself has a ZDR policy; your prompts are not retained unless you specifically opt in to prompt logging' (retrieved 2026-10-10) |
| Subprocessor list | https://trust.openrouter.ai/ — Enterprise Access Agreement Schedule 3 names the Trust Center as the current list of authorized sub-processors; downstream AI model providers are excluded from the 30-day subprocessor notice (DPA §5.2) and catalogued separately at openrouter.ai/models (retrieved 2026-10-10) |
| Enterprise tier | Downstream dependence is the whole story: some routed model providers may train on inputs/outputs unless the user opts out of provider-side training in account settings or enforces ZDR-only routing; where a provider's policy is unknown, OpenRouter conservatively flags it as retaining+training. Enterprise makes the posture contractual: DPA-incorporated ZDR, an EU-Only Processing Addendum (EU payloads processed only in the EU/EEA, routed only to EU providers, never used for training), and in-region routing via eu.openrouter.ai / us.openrouter.ai on Business/Enterprise plans. source — DPA (last updated 2026-08-26) Exhibit A 'EU-Only Processing Addendum': EU API payloads processed 'only in the European Union or EEA', routed only to EU Model Providers, and never used 'to train, fine-tune, improve, or develop models' (retrieved 2026-10-10) |
| Entry last reviewed | 2026-10-10 |