Processing exclusively within the EU
Platform in Frankfurt (AWS eu-central-1), inference and training in EU data centers.
Never used for our own models
Your content does not train Kontinent models. Weights and eval sets belong to you.
No prompt storage
Prompts and responses are not persisted, only billing metadata.
DPA chain, ISO 27001 in progress
DPA under Art. 28 GDPR with TOM annex available. SOC 2 Type II is on the roadmap.
[
DATA PATHS
]
Three paths your data can take to us
Which rules apply depends on the service. The details can be found in the DPA.
LLM Gateway
Serverless inference across open models from European providers
PROCESSED
Only in memory while the model is responding.
STORED
Metadata: Timestamp, model, tokens, cost, latency.
NOT STORED
Prompt and response content. Provider retention is listed in the compliance ranking.
Dedicated inference
Open models on GPUs reserved for you, in the EU
PROCESSED
On GPUs reserved exclusively for you, in the EU.
STORED
Your model and deployment operational metadata.
NOT STORED
Request content beyond processing.
Training
Your own models on your data, behind an eval gate before every rollout
PROCESSED
On EU infrastructure, with a DPA (Data Processing Agreement) before the first data record.
STORED
Datasets, evals, and checkpoints for as long as you need them.
YOURS
Weights, eval set, and documentation, exportable at any time.
[
PROVIDER REVIEW
]
How we vet subprocessors
01
Collect documents
Terms of service, DPAs, and certificates are gathered systematically.
02
Full-text review & clarifying questions
Every document is read in full; open points go back to the provider as clarifying questions.
03
Contractual evidence, not website claims
Only what's backed by contract clauses or written commitments is scored, not marketing copy.
04
Ongoing review with dated snapshots
Every rating carries a review date and is re-checked whenever something changes.
[
DOCUMENTS
]
The documents for your review
In the order a review usually needs them. Everything else on request.
Privacy notice
Roles, purposes, legal bases, and retention periods
Data processing agreement (DPA)
Art. 28 GDPR, with TOM and subprocessor annexes
Terms of service
The contract covering gateway, inference, and training
Acceptable use policy
Which uses are ruled out
Legal notice
The controlling entity and how to reach it
Compliance Ranking
Every provider, rated with a source for each criterion
Ranking methodology
How we rate, with a change log
Status and availability
Live status and latency per model
security.txt
How to report a security issue
On request
We provide the TOM annex, provider DPAs, certification confirmations, deletion confirmations, and completed security questionnaires on request.
Who to ask
Security questionnaires and evidence
The DPA and your contract
Requests about your own data
[
DETAILS
]
For your detailed review
Retention periods, access rights, subprocessors and technical evidence. Expand what your review needs.
Retention and deletion periods
What we store, for how long, and what happens at the end of the contract.
Who can access your data
Our team, our service providers, and you: who is allowed to see what.
Service providers and subprocessors
Who processes data on our behalf, for what purpose, and where.
Technical evidence
How we test zero retention and which controls apply in the product.