The GDPR-compliant AI gateway

Yes. Opper Technology AB is a Swedish company and processes your data under a published Data Processing Agreement (GDPR Article 28): your processor, and the single AI sub-processor on the list you keep for your own customers. The platform runs in AWS Stockholm, EU routes keep inference in Europe end to end on every plan, every sub-processor is listed on the trust center, Standard Contractual Clauses are available on request, no prompts are stored by default, Opper never trains on your data, and the company is certified against ISO/IEC 27001:2022. Your own compliance still depends on how you use AI, such as your lawful basis and which routes you call, and Opper lets you keep every call on EU routes.

It can be, and what matters is where the data is processed, what the provider retains, and whether your DPA covers the flow. Opper gives you EU-hosted routes for major models, acts as your single sub-processor, and provides a standard DPA with SCCs, so you can use frontier models while keeping processing in the EU and your paperwork unchanged.

Zero data retention means the model provider does not store your prompts or completions after the request is served, and runs no abuse monitoring that could hold them. A large share of the EU routes carry it on all traffic by default, and you can filter for it live in the model directory, either every model with zero data retention or the EU-hosted routes. Routes where content is kept only for abuse monitoring are marked Abuse monitoring, with their window; routes that keep content for other purposes are marked Retained. For OpenAI models on Azure and Gemini on Google Vertex, zero data retention without abuse monitoring is available under a signed Enterprise agreement; Claude on AWS Bedrock is zero data retention on pay-as-you-go.

Not when you route through Opper. You sign one DPA with Opper, and Opper maintains the sub-processor relationships with the model providers, so adding a new model does not require amending your DPA, notifying your customers, or waiting out a 30-day objection window. Opper's own sub-processors, every model provider included, are published on the trust center.

The Opper platform runs in AWS Stockholm, Sweden, and inference requests are processed in the region of the route you select. EU routes keep inference in Europe end to end on every plan, pay-as-you-go included: call an EU route's model id, or on Control Plane set a Model access rule with EU inference and storage locations for the whole organization. A model name without a provider prefix can be served from any region in its pool, and every EU route is listed at opper.ai/models/eu. Opper also runs as its own instance on evroc, the Swedish cloud, for sovereign workloads, and on Enterprise it can be deployed onto other clouds and regions.

Not by default. Opper stores metadata like model, token counts, latency, and cost for your analytics, while prompt and completion content is not retained. On top of that, many EU routes carry provider-side zero data retention by default, so prompts are not kept at either hop, and the model directory filters on it. Tracing is off by default on every plan, Control Plane included. When you want full traces, a Control Plane retention rule turns tracing on for the period you choose, and the Zero data retention policy in Model access allows only providers that neither train on nor log your content.

No, Opper never trains on your data. Each model provider's training posture is published on the trust center and in the provider directory, and the Zero data retention policy in Model access, on Control Plane, keeps every call away from providers that train on or log your content.

Every call is logged with model, cost, latency, and policy decisions, and the Control Plane adds retention rules, spend limits, and model allowlists, plus full traces of each call once you turn tracing on. That gives compliance teams the audit trail and documentation these reviews ask for.

Yes. Opper Technology AB is certified against ISO/IEC 27001:2022, the international standard for information security management. The controls it covers and the policies behind them are published on the Opper trust center at trust.opper.ai, next to the GDPR posture and the sub-processor register, the certificate itself is available there on request, and the trust center is continuously monitored rather than refreshed once a year.

Every plan, pay-as-you-go included, gets the EU routes, routes with zero data retention picked per call, no prompts stored by default, the standard DPA, and the ISO/IEC 27001:2022 certified platform in Stockholm. Control Plane adds Rules: data retention, so traces are stored only when you turn tracing on, for 1 to 30 days, and model access, which limits calls to the providers, inference and storage locations, and data policies you allow. Enterprise adds SSO/SAML, audit logging, zero data retention on the closed-model routes that need a signed agreement, tailored terms, and deployment in your own cloud or other regions. The full comparison is on the pricing page.

The standard Data Processing Agreement and the platform security overview are published on opper.ai, the sub-processor register is on the trust center, Standard Contractual Clauses are available on request, we sign the standard DPA on request, on Control Plane a model access rule limits the model providers that process your data to the ones you allow, and Enterprise agreements can carry tailored terms and extend zero retention to the usage metadata too. The ISO/IEC 27001:2022 controls and policies are published on the Opper trust center at trust.opper.ai, where the certificate is available on request.