Trust & compliance
AI APIs for regulated teams.
Zero data retention and suppliers we vet closely. A HIPAA-compliant environment, BAAs, DPAs, and regional data residency available upon request.
Where we stand
- Zero data retentionLiveEvery paying customer.
- HIPAA environment and BAAAvailableUpon request.
- DPAAvailableUpon request.
- Geographic data residencyAvailableUpon request.
- SOC 2 Type IIIn progressAsk us for current status.
For paying customers, prompts and completions are never stored.
Every paying customer gets zero data retention (ZDR), with nothing to switch on. Neither The Grid nor our suppliers keep the content of your requests or responses, and your data is never used for training or fine-tuning.
This covers every request, on both the Consumption API and the Anthropic Messages beta.
What we do keep
Only operational metadata needed to bill, route, and resolve disputes: timestamps, the instrument used, which supplier served the request, token counts, latency, error codes, and account details. Never prompt content, completions, message history, or files.
Suppliers we trust with your requests.
We handle model selection for you and route each request to the best-priced supplier, but only suppliers that clear our vetting are eligible. Every supplier is configured with zero data retention or an equivalent do-not-store control, and the full list, with each supplier's policy, is public in our docs.
- Each supplier is vetted before it can serve Grid traffic.
- Zero data retention, or an equivalent do-not-store control, is configured for every supplier.
- No single vendor holds your workload, so no one supplier can lock you in.
By industry
Built around what your industry has to protect.
Protected health information (PHI) should only reach vendors that will sign a BAA and do not keep it. Both have to be true at once.
A HIPAA-compliant environment
A HIPAA-compliant environment and a BAA are available upon request, so your compliance team has what it needs before PHI touches the API.
Nothing stored to leak
With zero data retention, prompts and completions containing PHI are not stored by The Grid or our suppliers. We keep only billing and routing metadata, such as token counts and timestamps.
Suppliers held to one standard
Every supplier is vetted and configured with zero data retention or an equivalent control. See the full supplier list and policies.
Data stays in region
Geographic data residency is available upon request, for health systems with state, national, or contractual limits on where data is processed.
Privilege and client confidentiality depend on who else can see or keep the material you send.
No copies left behind
For every paying customer, prompts, documents, and outputs are not stored or logged by The Grid or our suppliers, so there is no retained copy of client material to breach or disclose.
Never used for training
Your data is used only to serve your request, never for training or fine-tuning, by us or by our suppliers.
Retention you can verify
We publish every supplier and its data policy, so your ethics and security reviews do not have to rely on our word alone. See the full supplier list and policies.
Paperwork your risk team expects
DPAs are available upon request, and we will complete your firm or client security questionnaire.
Regulators expect documented due diligence on every third party that touches customer data, and on the parties behind them.
Fourth parties you can see
Our suppliers and their data policies are public, so you can document the full chain from your application to the model host. Zero data retention keeps customer data out of storage along the way. See the full supplier list and policies.
No concentration risk
Requests can be served by any of our vetted suppliers, so your workload does not depend on a single model vendor.
A due diligence package
Subprocessor lists, breach-notification terms, and security questionnaires are available upon request. Our SOC 2 Type II audit is in progress, so ask us for the current status.
Regional data residency
Geographic data residency is available upon request, for jurisdictions with data localization or outsourcing rules.
Your customers will send you a security questionnaire. Your inference vendor is one of the answers.
A promise you can pass on
Every paying customer gets zero data retention, so you can tell your customers their data is not stored by your inference layer.
Help with your reviews
Send us your customer questionnaire and we will complete it. We can provide a DPA or BAA when your customers require one.
Isolated, revocable access
API keys are shown once, stored only as hashes (plus a short prefix so you can identify them), and revocable at any time. Server-side products can register a dedicated OAuth application.
No vendor lock-in
You do not pick a specific model, and your integration does not depend on one. We handle model changes and deprecations behind one API, so nothing changes in your code.
Everything procurement and legal will ask for.
- HIPAA environment and BAA
- AvailableUpon request
- DPA (GDPR)
- AvailableUpon request
- Geographic data residency
- AvailableUpon request
- Subprocessor list
- AvailableUpon request. Our suppliers and their policies are already public in our docs.
- Breach notification
- AvailableStandard terms upon request, agreed in your contract.
- SOC 2 Type II
- Audit in progressContact us for current status and timeline.
- Security questionnaires
- AvailableSend us yours and we will complete it.
Common data and compliance questions.
Who gets zero data retention?
Every paying customer. Zero data retention is on from your first deposit, with nothing to configure, and it covers every request. Free accounts are for evaluation and do store prompts and completions, so make a deposit before you send anything sensitive.
Can you support HIPAA workloads?
Yes. A HIPAA-compliant environment and a BAA are both available upon request. Contact sales to scope them to your workload.
Do you offer a DPA?
Yes. A Data Processing Agreement is available upon request. A BAA covers HIPAA and a DPA covers GDPR and similar laws, so tell us which you need, or both, when you contact sales.
Do you have a SOC 2 report?
Our SOC 2 Type II audit is in progress, so there is no report to share yet. Contact us for the current status and expected timeline.
Where is my data processed?
Geographic data residency is available on request. Tell us the regions you need and we will confirm what we can commit to in your agreement.
Does ZDR cover everything?
It covers inference content: prompts, completions, message history, and files. We still keep operational metadata, such as token counts, timestamps, and which supplier served a request, to bill and route.
Is my data used to train models?
No. Your data is not used for training, fine-tuning, or anything other than serving your request.