Where Stav runs, what we keep, and who decides

Stav runs in Norway, on UpCloud in Stavanger. We keep request and routing logs for 90 days, the audit log for 24 months, and prompt content only while your workspace captures it. Your workspace policy decides which Inference Providers may serve your requests, and the router enforces it on every request.

Get API key See every Inference Provider

How we comply

Stav provides features and evidence, not legal advice. Your DPO makes the determination; this page says what is true today so they can.

GDPR

For the data your requests carry, Stav is the processor and you are the controller. Our DPA applies to every workspace when you accept the Terms. We also sign it on request. Our own platform runs in Norway (EEA); every vendor that touches your data is listed below, with where it processes.

CLOUD Act and FISA 702

Some vendors in our stack are US-owned: sign-in (Auth0, Okta, Inc.), payments (Stripe, LLC), error reports (Sentry), DNS and bot check (Cloudflare, Inc.), and nine of the Inference Providers in the catalogue. Your prompts reach a US-owned Inference Provider only when your workspace policy allows that provider, and the router enforces that per request. OpenAI counts as US-controlled even though EEA customers contract with OpenAI Ireland Ltd.; xAI contracts as SpaceXAI LLC. Account and payment data goes to the US-owned platform vendors under the EU-U.S. Data Privacy Framework, with Standard Contractual Clauses as the fallback; a US Inference Provider processes under the Standard Contractual Clauses in its Data Processing Agreement.

Data residency

Compute location is a fact per Provider Endpoint, sourced from the provider and shown on each provider page. Set a compute country or region in your key policy and the router serves only from endpoints that compute there; an endpoint whose country is not yet known is held out, never assumed. Stav itself — the gateway, the database, the logs — runs in Norway.

Retention

Request and routing logs: 90 days. Audit log: 24 months. Billing records: as long as the law requires. Prompt content: never stored, unless your workspace switches capture on — then encrypted per object at Jottacloud in Norway, for the window you set.

No training on your data

On by default for every workspace. The router serves only from Provider Endpoints whose provider states it does not train on prompts or completions — a fact sourced per endpoint, held out when unknown. Stav never trains on your data.

Evidence you can export

Every request is logged with its model, Inference Provider, compute country, zero-data-retention and no-training facts, and outcome, stamped when it ran. The request log and the audit log both export to CSV from your workspace.

Sub-processors

Who processes your data

Two lists. Platform vendors run the service around your requests and change rarely. Inference Providers serve the requests themselves; their list below is the live catalogue. Tools that never see customer data are not listed.

	What they do for Stav	What data they see	Where processed	Company in	Listed since
UpCloud	Hosting and database	All platform data	Norway	Finland	8 October 2026
Jottacloud	Storage of captured requests	Prompt content, only while you capture, encrypted per object	Norway

Certifications

What we hold and what we plan

Some Inference Providers hold their own certifications (for example SecNumCloud or BSI C5); each provider page lists them. Those are theirs, not Stav’s.

	State	Date	Today
ISO 27001	Planned	No date set	Not started. This row changes when work begins.
SOC 2 Type II	Planned	No date set	Not started. This row changes when work begins.

Regulations

What Stav gives you for each regulation

Features and evidence, per regime. Whether they satisfy your obligations is your determination to make.

EU AI Act

A record of which model and which Inference Provider served each request, with its compute country and retention facts, stamped at the time — the provenance a deployer file asks for. The catalogue names the model creator and the provider for every model.

DORA

A list of every third party that serves your requests, live, with its country and sovereignty level, plus the per-request log of which one served. A sovereignty floor and a blocked-provider list in your key policy, enforced at the gateway.

NIS2

An audit log of every change in your workspace — who, when, from where, and what changed — kept 24 months and exportable. API keys scoped per user and per team, with IP allowlists and rotation reminders.

CADA (Cloud and AI Development Act)

A proposed EU standard, in trilogue. Stav grades every Inference Provider on an L0–L4 ladder that follows the draft, with the criteria and sources shown on each provider page. It is our reading of a proposal, not a certification.

Contact

For a Data Processing Agreement, or a question about anything on this page, write to support@stav.ai. We answer from Norway.

Email us

Inference Providers

We send your request to one of these only when your workspace policy allows that Inference Provider. The list is the live catalogue, updated hourly. “Processes in” is where its Provider Endpoints compute: the country when the provider names one, otherwise the region it commits to. “Any region” means the provider does not fix where a request runs. “Not yet known” means no Provider Endpoint has a sourced country or region yet. A country policy admits only Provider Endpoints with a sourced country.

Inference Provider	Company in	Processes in	Sovereignty level	Listed since
AKI.IO	Germany	Germany	L1 · European-hosted	15 September 2026
Anthropic	United States	Any region (no fixed country)	L0 · Third-country operator	5 May 2026
Berget AI	Sweden	Sweden	L1 · European-hosted	19 August 2026
Cloudflare Workers AI	United States	Any region (no fixed country)	L0 · Third-country operator	27 August 2026
DeepInfra	United States	United States	L0 · Third-country operator	25 September 2026
Fireworks AI	United States	Any region (no fixed country)	L0 · Third-country operator	27 August 2026
FriendliAI	United States	United States	L0 · Third-country operator	25 September 2026
Google	United States	Any region (no fixed country)	L0 · Third-country operator	15 June 2026
Groq	United States	Any region (no fixed country)	L0 · Third-country operator	24 September 2026
Inceptron	Sweden	Finland, France	L1 · European-hosted	27 August 2026
Infomaniak AI Tools	Switzerland	Switzerland	L0 · Third-country operator	13 June 2026
Intility	Norway	Norway	L3 · Sovereign	15 October 2026
IONOS AI Model Hub	Germany	Germany	L1 · European-hosted	13 June 2026
Lyceum Technology	Germany	EU/EEA (no single country)	L1 · European-hosted	15 October 2026
Mistral	France	Spain, Netherlands, Norway, Sweden	L1 · European-hosted	15 June 2026
Nebius Token Factory	Netherlands	Finland, France	L2 · European operation	27 August 2026
Nextbit	Spain	Spain	L1 · European-hosted	27 August 2026
OpenAI	United States	United States	L0 · Third-country operator	5 May 2026
OVHcloud AI Endpoints	France	France	L1 · European-hosted	13 June 2026
Regolo	Italy	Italy	L3 · Sovereign	10 September 2026
Scaleway Generative APIs	France	France	L3 · Sovereign	13 June 2026
TensorX	Ireland	Finland, Ireland	L1 · European-hosted	15 September 2026
TypeSafe AI	United States	United States	L0 · Third-country operator	10 October 2026
xAI	United States	Any region (no fixed country)	L0 · Third-country operator	27 July 2026