Compliance
Compliance status and controls, on the record.
nRouter's SOC 2 Type II audit is in progress — it is not yet certified. Today it operates SOC 2-aligned security, availability and confidentiality controls: encryption, access control, change management, audit logging and tenant isolation. Its infrastructure substrate, Microsoft Azure and managed database services, is SOC 2 Type II certified, and a Data Processing Addendum is available for signature.
Where every framework stands.
Status comes from one source of truth and is never overstated.
SOC 2 Type II
SOC 2-aligned security, availability, and confidentiality controls. Formal Type II audit in progress.Audit in progressISO/IEC 27001
Information security practices aligned to ISO/IEC 27001 Annex A controls. Certification planned.Aligned — certification plannedGDPR
EU GDPR compliant with a Data Processing Agreement, Standard Contractual Clauses, and EU residency.Compliant — DPA availableHIPAA
HIPAA-eligible workloads with a Business Associate Agreement and in-path PII redaction.BAA available on EnterprisePCI DSS
All payments processed by Stripe (PCI DSS Level 1). Card numbers never reach our servers.Stripe PCI L1 — no card data on our serversData residency
US East (Virginia) by default, with EU, UK, Canada, Australia, Singapore, and India on request.US GA · EU + more on request
What we ship per framework.
The controls and agreements supporting each compliance program.
SOC 2 Type II (audit in progress).
SOC 2-aligned controls run continuously in production while the Type II observation period is underway.
- AES-256 encryption at rest and TLS 1.2+ with HSTS in transit
- Postgres Row-Level Security on every tenant table
- Append-only audit trail with actor, IP, and diff on admin actions
GDPR.
EU data protection terms, cross-border transfer mechanisms, and zero inference payload retention.
- Published Data Processing Agreement with Standard Contractual Clauses
- Data-subject access, erasure, portability, and restriction rights
- Prompts and completions are never persisted to disk
HIPAA.
Healthcare workloads supported with a Business Associate Agreement and in-path PII redaction.
- Business Associate Agreement available for Enterprise workloads
- Output PII redaction on buffered responses plus optional pre-call rules
- Audit logging across administrative and key management events
PCI DSS (delegated to Stripe).
Payment processing is delegated to Stripe, a PCI DSS Level 1 certified service provider.
- Zero raw cardholder data stored or processed on nRouter servers
- Client-side tokenization via Stripe Elements on every checkout
- Webhook signature verification and idempotency on Stripe events
Data protection controls.
Measure-by-measure controls enforced across the platform.
Encryption in transit and at rest.
TLS 1.2+ (HSTS preloaded) for all network traffic and AES-256 across Postgres, Redis, and object storage.
Database tenant isolation.
Row-Level Security is enabled on every tenant table so queries are isolated to a single organization.
Key hashing and authentication.
Virtual keys are SHA-256 hashed with plaintext shown once. Dashboard sessions use JWT-based authentication.
Reserve and settle billing.
Credits are reserved prior to dispatch and settled atomically at the served model’s exact list price.
Inference payload retention.
Zero retention by default: prompt and completion text is processed in memory and never written to disk.
Operational and financial retention.
Request metadata logs auto-purge after 7 to 30 days. Financial billing records are retained for 7 years.
Legal and compliance documents.
Self-serve agreements and subprocessor disclosures.
Data Processing Agreement (DPA)
EU/EEA processing terms, Standard Contractual Clauses, subprocessor commitments, and security exhibit./legal/dpaService Level Agreement (SLA)
99.9% contractual uptime target with service credits and custom Enterprise SLA terms./legal/slaSubprocessors
The third-party infrastructure and service providers used to deliver nRouter, with 30-day change notice./legal/subprocessorsAcceptable Use Policy (AUP)
Permitted and prohibited uses of the platform and how policy enforcement works./legal/aupPrivacy Policy
How account and operational metadata is collected, used, and protected, plus your privacy rights./privacyTerms of Service
Contractual terms governing pay-as-you-go usage, virtual keys, and organization accounts./terms
Request documentation.
Counter-signed agreements, vendor questionnaires, and controls walkthroughs.