OpenRouter
Certifications and attestations: SOC 2 Type II
Certifications as listed on OpenRouter's trust center (evidence) ; reports themselves are usually shared on request.
Transparency
Breakdown
| Subprocessor list | 30 / 30 | |
| Processing locations | 8 / 8 | |
| Purposes | 7 / 7 | |
| Data processing addendum | 12 / 12 | |
| Trust center | 8 / 8 | |
| Privacy policy | 6 / 6 | |
| security.txt | 6 / 6 | |
| Security page | not found | 0 / 5 |
| Status page | 5 / 5 | |
| Vulnerability disclosure | not found | 0 / 5 |
| Pages still reachable | 8 / 8 | |
| Total | 90 / 100 |
Only documents we can retrieve count: a page behind a login or a broken link scores nothing.
Badge
For OpenRouter's own site; it updates with the rating.
<a href="https://thirdpartyindex.com/vendors/openrouter"><img src="https://thirdpartyindex.com/badge/openrouter.svg" alt="OpenRouter transparency rating on Third Party Index" height="20"></a>[](https://thirdpartyindex.com/vendors/openrouter)Documents
| Document | Verified | Changed | Evidence |
|---|---|---|---|
| Trust center safebase | snapshot | ||
| Subprocessor list | snapshot | ||
| Data processing addendum safebase | snapshot | ||
| Privacy policy | snapshot | ||
| Terms | snapshot | ||
| security.txt | snapshot | ||
| Status page | snapshot |
Subprocessors
| Name | Purpose | Location | Listed since |
|---|---|---|---|
| Clerk | Authentication | United States | |
| ClickHouse | Database | United States | |
| Cloudflare | Cloud Infrastructure | United States | |
| Coinbase | Payments | United States | |
| Customer.io | Email Notifications | United States | |
| Datadog | Observability | United States | |
| Fivetran | Integrations | United States | |
| GitHub | Version Control | United States | |
| OpenAI | Inference | United States | |
| PostHog | Analytics | United States | |
| Pylon | Customer Support | United States | |
| Resend | Email Notifications | United States | |
| Stripe | Payments | United States | |
| Upstash | Cache | United States | |
| Vercel | Website Hosting | United States | |
| Zendesk® | Customer Support | United States |
Listed as a subprocessor by (12)
Purposes as each company states them.
Anaconda anaconda.com Routes AI model requests and related data
Descript descript.com
Hasura hasura.io
Kaltura kaltura.com AI Gateway
Mintlify mintlify.com LLM Provider
Netlify netlify.com AI Services
Orderful orderful.com AI model routing / proxy
Relevance AI relevanceai.com AI Models; Engineering
Todoist todoist.com **Purpose:** Routes Automations AI requests to the approved model providers listed below | **AI Data Retention:** Zero-data-retention routing enforced account-wide. OpenRouter does not store prompt content. | **Privacy info:** [Policy](https://openrouter.ai/privacy) | **Reference:** [Per-provider retention and logging table](https://openrouter.ai/docs/guides/privacy/provider-logging) Todoist uses OpenRouter as a subprocessor to route Automations AI requests to the providers listed below, which run DeepSeek V4 Flash 0731. **Approved model providers** (Model: DeepSeek V4 Flash 0731): [Atlas Cloud AI Inc.](https://www.atlascloud.ai/privacy) (US), [BaseTen Labs, Inc.](https://www.baseten.co/privacy-policy/) (US), [CoreWeave, Inc.](https://docs.coreweave.com/policies/terms-of-service/privacy-policy) (US), [DeepInfra, Inc.](https://deepinfra.com/privacy) (US), [Fireworks.ai, Inc.](https://fireworks.ai/privacy-policy) (US), [Inceptron AB](https://www.inceptron.io/privacy) (Sweden, EU/EEA-only processing), [Novita AI](https://novita.ai/legal/privacy-policy) (US), [Parasail, Inc.](https://www.parasail.io/legal/privacy-policy) (US), [Siliconflow Labs Pte. Ltd.](https://docs.siliconflow.com/en/legals/privacy-policy) (Singapore), [Together Computer, Inc.](https://www.together.ai/privacy) (US), [Venice.ai, Inc.](https://venice.ai/legal/privacy-policy) (US); AI Routing Service
Together AI together.ai AI model routing and aggregation
Upstash upstash.com
replit replit.com
Changes
None since tracking began.