{"as_of":1789486920,"answers_as_of":{"oldest":"2026-08-04","newest":"2026-08-04","age_days":42,"slo_days":14,"dated":21,"undated":1,"stale":true,"says":"Last checked 2026-08-04 — 42 days ago. 1 of 22 carry no date at all, so the set as a whole is out of date until they do."},"digest":"9cd15106aa295a898703b9b80711510c","notice_days":30,"contact":"privacy@host.rodeo","count":27,"sub_processors":[{"id":"aionlabs","name":"AionLabs","role":"model host","lane":"free","endpoint":"api.aionlabs.ai","status":"active","entity":"AionLabs","home_country":"unknown","processing_region":"unknown","keeps_your_text":"unknown","trains_on_your_text":"unknown","policy_source":"https://www.aionlabs.ai/","policy_checked":"2026-08-04","default_lane":{"admitted":true,"basis":"named_entity","reason":"We can name the company that receives this work.","as_of":"2026-08-04"},"note":"Retention and training terms NOT verified first-party; both read 'unknown'. NOT sovereign-eligible."},{"id":"anthropic","name":"Anthropic","role":"model host","lane":"paid","endpoint":"api.anthropic.com","status":"active","entity":"Anthropic PBC","home_country":"US","processing_region":"unknown","keeps_your_text":"retained","trains_on_your_text":"false","policy_source":"https://privacy.claude.com/en/articles/7996868-is-my-data-used-for-model-training","policy_checked":"2026-08-04","default_lane":{"admitted":true,"basis":"named_entity","reason":"We can name the company that receives this work.","as_of":"2026-08-04"},"note":"'By default, we will not use your inputs or outputs from our commercial products (e.g. Claude for Work, Anthropic API, Claude Gov, etc.) to train our models.' Explicit thumbs-up/down feedback is the documented exception and we never send it. Limited retention; no published default window on that page. NOT sovereign-eligible."},{"id":"bazaarlink","name":"Bazaarlink","role":"router","lane":"free","endpoint":"bazaarlink.ai","status":"active","entity":"Bazaarlink","home_country":"unknown","processing_region":"unknown","keeps_your_text":"unknown","trains_on_your_text":"unknown","policy_source":"https://bazaarlink.ai/","policy_checked":"2026-08-04","default_lane":{"admitted":true,"basis":"named_entity","reason":"We can name the company that receives this work.","as_of":"2026-08-04"},"note":"ROUTER, not a model host — the ultimate processor is chosen per request, so retention and training read 'unknown'. NOT sovereign-eligible."},{"id":"cloudflare-workers-ai","name":"Cloudflare Workers AI","role":"model host","lane":"free","endpoint":"api.cloudflare.com","status":"active","entity":"Cloudflare, Inc.","home_country":"US","processing_region":"unknown","keeps_your_text":"none","trains_on_your_text":"false","policy_source":"https://developers.cloudflare.com/workers-ai/platform/data-usage/","policy_checked":"2026-08-04","default_lane":{"admitted":true,"basis":"named_entity","reason":"We can name the company that receives this work.","as_of":"2026-08-04"},"note":"Cloudflare does not automatically store prompts or responses, and states it 'does not use your Customer Content to (1) train any AI models made available on Workers AI or (2) improve any Cloudflare or third-party services'. Inference LOCATION is not published, so region stays unrecorded. NOT sovereign-eligible."},{"id":"cohere","name":"Cohere","role":"model host","lane":"free","endpoint":"api.cohere.ai","status":"active","entity":"Cohere Inc.","home_country":"CA","processing_region":"unknown","keeps_your_text":"unknown","trains_on_your_text":"unknown","policy_source":"https://cohere.com/terms-of-use","policy_checked":"2026-08-04","default_lane":{"admitted":true,"basis":"named_entity","reason":"We can name the company that receives this work.","as_of":"2026-08-04"},"note":"READ THIS ONE BEFORE SENDING ANYTHING SENSITIVE. Cohere's Terms of Use reserve the right to 'use, process, store, disclose and transmit any ... CUSTOMER DATA ... to improve and enhance the COHERE SOLUTION'. That is an improvement right, which is not word-for-word a model-training right, so neither flag is recorded and both read 'unknown'. No retention period is published. NOT sovereign-eligible."},{"id":"google","name":"Google AI Studio","role":"model host","lane":"free","endpoint":"generativelanguage.googleapis.com","status":"active","entity":"Google LLC","home_country":"US","processing_region":"unknown","keeps_your_text":"retained","trains_on_your_text":"true","policy_source":"https://ai.google.dev/gemini-api/terms","policy_checked":"2026-08-04","default_lane":{"admitted":true,"basis":"named_entity","reason":"We can name the company that receives this work.","as_of":"2026-08-04"},"note":"UNPAID tier — which is the tier we use. Google's own words: 'Google uses the content you submit to the Services and any generated responses to provide, improve, and develop Google products' and 'human reviewers may read, annotate, and process your API input and output'. The PAID tier is the opposite ('Google doesn't use your prompts ... to improve our products', 30-day abuse logging only). NOT sovereign-eligible."},{"id":"groq","name":"Groq","role":"model host","lane":"free","endpoint":"api.groq.com","status":"active","entity":"Groq, Inc.","home_country":"US","processing_region":"unknown","keeps_your_text":"unknown","trains_on_your_text":"unknown","policy_source":"https://console.groq.com/docs/legal/customer-data-processing-addendum","policy_checked":"2026-08-04","default_lane":{"admitted":true,"basis":"named_entity","reason":"We can name the company that receives this work.","as_of":"2026-08-04"},"note":"Groq's DPA confines processing to providing the service and gives a 180-day maximum deletion window after termination, and Groq publishes its own sub-processor list at https://trust.groq.com/subprocessors with 15 days' notice of changes. It does not contain an explicit 'we do not train on your prompts' sentence, so neither flag is recorded — purpose limitation is not the same statement as a no-training commitment. NOT sovereign-eligible."},{"id":"huggingface","name":"Hugging Face Router","role":"router","lane":"free","endpoint":"router.huggingface.co","status":"active","entity":"Hugging Face, Inc.","home_country":"US","processing_region":"unknown","keeps_your_text":"unknown","trains_on_your_text":"unknown","policy_source":"https://huggingface.co/docs/inference-providers/index","policy_checked":"2026-08-04","default_lane":{"admitted":true,"basis":"named_entity","reason":"We can name the company that receives this work.","as_of":"2026-08-04"},"note":"ROUTER, not a model host. Hugging Face's router forwards to a partner network that includes Cerebras, Cohere, DeepInfra, Fal, Featherless, Fireworks, Groq, HF Inference, Novita, Nscale, OVHcloud, Public AI, Replicate, Scaleway, Together, WaveSpeed and Z.ai, and by default picks 'the fastest available provider'. The company that sees the prompt is therefore decided per request and both flags stay 'unknown'. NOT sovereign-eligible."},{"id":"kilo","name":"Kilo Code","role":"router","lane":"free","endpoint":"api.kilo.ai","status":"active","entity":"Kilo Code","home_country":"unknown","processing_region":"unknown","keeps_your_text":"unknown","trains_on_your_text":"unknown","policy_source":"https://kilocode.ai/","policy_checked":"2026-08-04","default_lane":{"admitted":true,"basis":"named_entity","reason":"We can name the company that receives this work.","as_of":"2026-08-04"},"note":"ROUTER, not a model host — the ultimate processor is chosen per request, so retention and training read 'unknown'. NOT sovereign-eligible."},{"id":"llm7","name":"llm7","role":"model host","lane":"free","endpoint":"api.llm7.io","status":"not in use","entity":"unknown","home_country":"unknown","processing_region":"unknown","keeps_your_text":"unknown","trains_on_your_text":"unknown","policy_source":null,"policy_checked":null,"default_lane":{"admitted":false,"basis":"no_identifiable_operator","reason":"We cannot name the company behind this service, so it does not receive work from anyone who has not asked for it by name.","as_of":null},"note":null},{"id":"mistral","name":"Mistral","role":"model host","lane":"free","endpoint":"api.mistral.ai","status":"active","entity":"Mistral AI SAS","home_country":"FR","processing_region":"unknown","keeps_your_text":"retained","trains_on_your_text":"true","policy_source":"https://legal.mistral.ai/terms/privacy-policy","policy_checked":"2026-08-04","default_lane":{"admitted":true,"basis":"named_entity","reason":"We can name the company that receives this work.","as_of":"2026-08-04"},"note":"Mistral uses 'Your Input and Output, subject to your opt-out' for training, and keeps standard-API input/output for 'thirty (30) rolling days'. The opt-out exists in account settings and we have NOT exercised it — so 'true' is what is true today, not what is unavoidable. NOT sovereign-eligible."},{"id":"moonshot","name":"Moonshot AI (Kimi)","role":"model host","lane":"paid","endpoint":"api.moonshot.ai","status":"active","entity":"Moonshot AI","home_country":"CN","processing_region":"unknown","keeps_your_text":"unknown","trains_on_your_text":"unknown","policy_source":"https://platform.moonshot.ai/docs/agreement/modeldoc","policy_checked":"2026-08-04","default_lane":{"admitted":true,"basis":"named_entity","reason":"We can name the company that receives this work.","as_of":"2026-08-04"},"note":"Retention and training terms are NOT yet verified first-party, so both read 'unknown' rather than being claimed. Company home jurisdiction is China, which matters for an international transfer assessment. NOT sovereign-eligible."},{"id":"nvidia","name":"NVIDIA NIM","role":"model host","lane":"free","endpoint":"integrate.api.nvidia.com","status":"not in use — our health check needs attention","entity":"NVIDIA Corporation","home_country":"US","processing_region":"unknown","keeps_your_text":"unknown","trains_on_your_text":"unknown","policy_source":"https://www.nvidia.com/en-us/about-nvidia/privacy-policy/","policy_checked":"2026-08-04","default_lane":{"admitted":true,"basis":"named_entity","reason":"We can name the company that receives this work.","as_of":"2026-08-04"},"note":"Hosted NIM API retention and training terms NOT verified first-party; both read 'unknown'. NOT sovereign-eligible."},{"id":"ollama","name":"Ollama Cloud","role":"model host","lane":"free","endpoint":"ollama.com","status":"not in use — we have not funded this account","entity":"Ollama Inc.","home_country":"US","processing_region":"unknown","keeps_your_text":"none","trains_on_your_text":"false","policy_source":"https://ollama.com/privacy","policy_checked":"2026-08-04","default_lane":{"admitted":true,"basis":"named_entity","reason":"We can name the company that receives this work.","as_of":"2026-08-04"},"note":"'We do not use your inputs or outputs to train any AI models' and cloud prompts are processed 'transiently ... and never train on it'. Ollama states data 'may be transferred to and processed in the United States' and that it uses unnamed cloud infrastructure and model inference providers of its own. NOT sovereign-eligible."},{"id":"openai","name":"OpenAI","role":"model host","lane":"paid","endpoint":"api.openai.com","status":"active","entity":"OpenAI, L.L.C.","home_country":"US","processing_region":"unknown","keeps_your_text":"retained","trains_on_your_text":"false","policy_source":"https://openai.com/enterprise-privacy/","policy_checked":"2026-08-04","default_lane":{"admitted":true,"basis":"named_entity","reason":"We can name the company that receives this work.","as_of":"2026-08-04"},"note":"API inputs and outputs are not used to train OpenAI's models, and are retained up to 30 days for abuse monitoring unless a zero-data-retention agreement is in place. We do NOT hold a zero-retention agreement, so 30 days is what is true for us. NOT sovereign-eligible."},{"id":"openrouter","name":"OpenRouter","role":"router","lane":"free","endpoint":"openrouter.ai","status":"active","entity":"OpenRouter, Inc.","home_country":"US","processing_region":"unknown","keeps_your_text":"unknown","trains_on_your_text":"unknown","policy_source":"https://openrouter.ai/docs/features/privacy-and-logging","policy_checked":"2026-08-04","default_lane":{"admitted":true,"basis":"named_entity","reason":"We can name the company that receives this work.","as_of":"2026-08-04"},"note":"ROUTER, not a model host. OpenRouter's own words: 'Each AI provider on OpenRouter has its own data handling policies for logging and retention.' The company that actually sees the prompt is chosen by OpenRouter per request, so no single retention or training answer is true for this row and both stay 'unknown'. OpenRouter publishes per-endpoint retention and offers zero-data-retention endpoints and a training opt-out we have not enabled. NOT sovereign-eligible."},{"id":"ovhcloud","name":"OVHcloud AI Endpoints","role":"model host","lane":"free","endpoint":"oai.endpoints.kepler.ai.cloud.ovh.net","status":"active","entity":"OVH Groupe SAS","home_country":"FR","processing_region":"unknown","keeps_your_text":"none","trains_on_your_text":"false","policy_source":"https://www.ovhcloud.com/en/public-cloud/ai-endpoints/","policy_checked":"2026-08-04","default_lane":{"admitted":true,"basis":"named_entity","reason":"We can name the company that receives this work.","as_of":"2026-08-04"},"note":"'Your data will never be used to train or improve our AI models' and 'Zero data retention: We keep only the data required for billing purposes.' The same page also lists 'Worldwide availability (non-EU)' for the Base and Batch APIs, so the processing REGION is ambiguous and stays unrecorded rather than being claimed as EU. NOT sovereign-eligible."},{"id":"requesty","name":"Requesty free models","role":"router","lane":"free","endpoint":"router.requesty.ai","status":"retired by the provider","entity":"Requesty","home_country":"unknown","processing_region":"unknown","keeps_your_text":"unknown","trains_on_your_text":"unknown","policy_source":"https://requesty.ai/","policy_checked":"2026-08-04","default_lane":{"admitted":true,"basis":"named_entity","reason":"We can name the company that receives this work.","as_of":"2026-08-04"},"note":"ROUTER, not a model host — the ultimate processor is chosen per request, so retention and training read 'unknown'. NOT sovereign-eligible."},{"id":"sambanova","name":"SambaNova","role":"model host","lane":"free","endpoint":"api.sambanova.ai","status":"active","entity":"SambaNova Systems, Inc.","home_country":"US","processing_region":"unknown","keeps_your_text":"unknown","trains_on_your_text":"unknown","policy_source":"https://sambanova.ai/privacy-policy","policy_checked":"2026-08-04","default_lane":{"admitted":true,"basis":"named_entity","reason":"We can name the company that receives this work.","as_of":"2026-08-04"},"note":"SambaNova's public privacy policy explicitly does not cover data processed on behalf of Cloud customers, and we could not reach a published Cloud data-processing term. Both flags read 'unknown'. NOT sovereign-eligible."},{"id":"vercel","name":"Vercel AI Gateway","role":"router","lane":"free","endpoint":"ai-gateway.vercel.sh","status":"active","entity":"Vercel Inc.","home_country":"US","processing_region":"unknown","keeps_your_text":"unknown","trains_on_your_text":"unknown","policy_source":"https://vercel.com/docs/ai-gateway/security-and-compliance/disallow-prompt-training","policy_checked":"2026-08-04","default_lane":{"admitted":true,"basis":"named_entity","reason":"We can name the company that receives this work.","as_of":"2026-08-04"},"note":"ROUTER, not a model host. Vercel says of ITSELF: 'AI Gateway does not use your prompts or responses for training purposes.' But of the providers behind it: 'By default, AI Gateway does not route based on the training data policy of providers', and 'If we do not know a provider's training data stance ... we assume that they train on your data.' A `disallowPromptTraining: true` request option and a team-wide zero-data-retention setting both exist and we have NOT enabled either. So the honest value for the model that actually runs is 'unknown'. NOT sovereign-eligible."},{"id":"xai","name":"xAI (Grok)","role":"model host","lane":"paid","endpoint":"api.x.ai","status":"active","entity":"X.AI LLC","home_country":"US","processing_region":"unknown","keeps_your_text":"retained","trains_on_your_text":"unknown","policy_source":"https://x.ai/legal/terms-of-service","policy_checked":"2026-08-04","default_lane":{"admitted":true,"basis":"named_entity","reason":"We can name the company that receives this work.","as_of":"2026-08-04"},"note":"xAI API data handling has NOT been verified first-party by us, so trains_on_data stays unrecorded and reads 'unknown'. Verify current terms at enrollment before any sensitivity grant. NOT sovereign-eligible."},{"id":"zai","name":"Z.ai","role":"model host","lane":"free","endpoint":"api.z.ai","status":"active","entity":"Z.ai (Zhipu AI)","home_country":"CN","processing_region":"unknown","keeps_your_text":"unknown","trains_on_your_text":"unknown","policy_source":"https://z.ai/terms/privacy-policy","policy_checked":"2026-08-04","default_lane":{"admitted":true,"basis":"named_entity","reason":"We can name the company that receives this work.","as_of":"2026-08-04"},"note":"Retention and training terms NOT verified first-party; both read 'unknown'. Company home jurisdiction is China, which matters for an international transfer assessment. NOT sovereign-eligible."}],"infrastructure":[{"id":"api.met.no","name":"Norwegian Meteorological Institute (MET Norway)","role":"weather data","purpose":"the one-line weather in Clint's greeting","sees":"a coordinate rounded to about 100 metres, and our own address. Never the customer, never their browser, never a pattern of when they sign in.","country":"NO","evidence":"https://api.met.no/doc/TermsOfService","note":"NLOD 2.0 + CC BY 4.0 — commercial use permitted, no key, no fee. We must: attribution, an identifying User-Agent, and client-side caching. Terms read 2026-08-14; country checked 2026-09-13. The Norwegian Meteorological Institute is a Norwegian state agency and its own terms of service name Oslo. Read from those terms, not assumed from the domain."},{"id":"cloudflare-edge","name":"Cloudflare, Inc.","role":"edge / network","purpose":"TLS termination and the tunnel that carries traffic to the server","sees":"Requests in transit, including prompt text while it passes through, plus connection metadata (IP address, timing). Nothing is stored by us at this layer.","country":"US","evidence":"infra/edge/cloudflared.yml","note":"Also appears in the model-source list as Workers AI, which is a different service under the same company."},{"id":"nominatim.openstreetmap.org","name":"OpenStreetMap Foundation (Nominatim)","role":"place lookup","purpose":"turning a town the customer typed into a coordinate, once, when they type it","sees":"the town they typed, and our own address.","country":"GB","evidence":"https://operations.osmfoundation.org/policies/nominatim/","note":"ODbL — free use within the published usage policy. We must: no autocomplete, no systematic querying, at most 1 request a second, and the result cached rather than re-asked. Terms read 2026-08-14; country checked 2026-09-13. Their own privacy policy says personal data is stored in the United Kingdom and the Netherlands, and the Foundation answers to the UK Companies Act. GB is the strongest single answer that evidence supports; it is not a datacentre attestation and we do not present it as one."},{"id":"resend","name":"Resend","role":"transactional email","purpose":"Sends account email — password resets and service notices","sees":"The email address a message is sent to, and the content of that message.","country":"US","evidence":"infra/gateway/app/mailer.py (vault path secret/hostrodeo/resend)","note":"Never receives prompt or answer content."},{"id":"ssdnodes","name":"SSD Nodes (Strasmore, Inc.)","role":"hosting","purpose":"Runs the Host.Rodeo server itself","sees":"Everything the service holds, as the operator of the physical machine: account records, request metadata, encrypted secrets at rest. Not prompt or answer text, which is never written to disk.","country":"US","evidence":"ARIN registration for 172.93.54.223 — Strasmore, Inc., Tustin CA, country US","note":"The country here is the registered network block, which is the strongest evidence we have. It is not a datacentre attestation and we do not present it as one."}],"your_own_machines":{"excluded":true,"why":"Machines a customer installs and runs on their own hardware are not sub-processors — nobody else is in that path. They are not listed here, because they are not ours to publish.","how_to_see_yours":"Sign in; your own machines are on your range."},"unverified_policies":["aionlabs","bazaarlink","cohere","groq","huggingface","kilo","llm7","moonshot","nvidia","openrouter","requesty","sambanova","vercel","xai","zai"],"policy_dispositions":[{"id":"aionlabs","disposition":"terms_published_not_read","means":"This company is named and publishes terms; we have not yet read and recorded them first-hand, and we will not summarise terms we have not read.","what_would_settle_it":"Reading the company's published terms and recording them, with the date and the link.","permanent":false,"checked":"2026-08-04"},{"id":"bazaarlink","disposition":"router_chooses_per_request","means":"This company is itself a gateway: it picks which provider runs the model, per request, and does not tell us which. No single answer exists, so unknown is permanently the true one.","what_would_settle_it":"Nothing will. Route work that needs a named processor to a lane where one exists — your own machine, or a provider we have verified.","permanent":true,"checked":"2026-08-04"},{"id":"cohere","disposition":"terms_published_not_read","means":"This company is named and publishes terms; we have not yet read and recorded them first-hand, and we will not summarise terms we have not read.","what_would_settle_it":"Reading the company's published terms and recording them, with the date and the link.","permanent":false,"checked":"2026-08-04"},{"id":"groq","disposition":"terms_published_not_read","means":"This company is named and publishes terms; we have not yet read and recorded them first-hand, and we will not summarise terms we have not read.","what_would_settle_it":"Reading the company's published terms and recording them, with the date and the link.","permanent":false,"checked":"2026-08-04"},{"id":"huggingface","disposition":"router_chooses_per_request","means":"This company is itself a gateway: it picks which provider runs the model, per request, and does not tell us which. No single answer exists, so unknown is permanently the true one.","what_would_settle_it":"Nothing will. Route work that needs a named processor to a lane where one exists — your own machine, or a provider we have verified.","permanent":true,"checked":"2026-08-04"},{"id":"kilo","disposition":"router_chooses_per_request","means":"This company is itself a gateway: it picks which provider runs the model, per request, and does not tell us which. No single answer exists, so unknown is permanently the true one.","what_would_settle_it":"Nothing will. Route work that needs a named processor to a lane where one exists — your own machine, or a provider we have verified.","permanent":true,"checked":"2026-08-04"},{"id":"llm7","disposition":"no_identifiable_operator","means":"We cannot identify the legal entity behind this service and it publishes no data-processing terms we can read. This is a decision about whether to use it at all, not a lookup.","what_would_settle_it":"A decision to drop the source, or a dated, recorded acceptance of using it anyway.","permanent":false,"checked":null},{"id":"moonshot","disposition":"terms_published_not_read","means":"This company is named and publishes terms; we have not yet read and recorded them first-hand, and we will not summarise terms we have not read.","what_would_settle_it":"Reading the company's published terms and recording them, with the date and the link.","permanent":false,"checked":"2026-08-04"},{"id":"nvidia","disposition":"terms_published_not_read","means":"This company is named and publishes terms; we have not yet read and recorded them first-hand, and we will not summarise terms we have not read.","what_would_settle_it":"Reading the company's published terms and recording them, with the date and the link.","permanent":false,"checked":"2026-08-04"},{"id":"openrouter","disposition":"router_chooses_per_request","means":"This company is itself a gateway: it picks which provider runs the model, per request, and does not tell us which. No single answer exists, so unknown is permanently the true one.","what_would_settle_it":"Nothing will. Route work that needs a named processor to a lane where one exists — your own machine, or a provider we have verified.","permanent":true,"checked":"2026-08-04"},{"id":"requesty","disposition":"router_chooses_per_request","means":"This company is itself a gateway: it picks which provider runs the model, per request, and does not tell us which. No single answer exists, so unknown is permanently the true one.","what_would_settle_it":"Nothing will. Route work that needs a named processor to a lane where one exists — your own machine, or a provider we have verified.","permanent":true,"checked":"2026-08-04"},{"id":"sambanova","disposition":"terms_published_not_read","means":"This company is named and publishes terms; we have not yet read and recorded them first-hand, and we will not summarise terms we have not read.","what_would_settle_it":"Reading the company's published terms and recording them, with the date and the link.","permanent":false,"checked":"2026-08-04"},{"id":"vercel","disposition":"router_chooses_per_request","means":"This company is itself a gateway: it picks which provider runs the model, per request, and does not tell us which. No single answer exists, so unknown is permanently the true one.","what_would_settle_it":"Nothing will. Route work that needs a named processor to a lane where one exists — your own machine, or a provider we have verified.","permanent":true,"checked":"2026-08-04"},{"id":"xai","disposition":"terms_published_not_read","means":"This company is named and publishes terms; we have not yet read and recorded them first-hand, and we will not summarise terms we have not read.","what_would_settle_it":"Reading the company's published terms and recording them, with the date and the link.","permanent":false,"checked":"2026-08-04"},{"id":"zai","disposition":"terms_published_not_read","means":"This company is named and publishes terms; we have not yet read and recorded them first-hand, and we will not summarise terms we have not read.","what_would_settle_it":"Reading the company's published terms and recording them, with the date and the link.","permanent":false,"checked":"2026-08-04"}],"open_obligations":[{"id":"review","state":"deferred","as_of":"2026-09-13","decided_by":"coordinator","what":"The legal shelf was written by the engineering team so that every factual claim traces to running code. No qualified data-protection lawyer has read it, and the page says so.","question":"Do we commission an external legal review of the shelf, and when?","decision":"NOT YET, and the trigger is written down instead of a date. A review buys confidence in claims made to customers; today there are no customers to make them to, so it would be confidence in an audience of nobody. It is commissioned when the first controller who is not us signs the DPA, or at the first paid business customer, whichever comes first.","trigger":"first non-first-party controller signs the DPA, or first paid business customer"},{"id":"representative","state":"basis-recorded","as_of":"2026-09-13","decided_by":"coordinator","what":"No Article 27 representative is appointed in the UK or the EEA. A US-based processor serving UK/EEA controllers may need one.","question":"Do we appoint an Article 27 representative — and if not, on what recorded basis do we conclude one is not required?","decision":"A REPRESENTATIVE IS REQUIRED, and this answer is not the one that was expected. The plan was to record Article 27(2)(a) — processing that is occasional, carries no large-scale special-category or criminal-offence data, and is unlikely to risk anyone's rights — as our basis for not appointing one. Rather than write that basis down as a sentence, it was built as a measurement (`representative_basis()`), because the exemption is cumulative, regulators read 'occasional' narrowly, and a basis that expires quietly is the exact defect this register exists to end.\n\nThe measurement immediately refused the basis. There is a live account that is not ours, on a French consumer ISP domain — an EEA data subject, today, with the founder's own signups excluded by the same predicate the operator's roster uses. One account is arguably still 'occasional', and a lawyer might well say so; the measurement does not soften itself to reach that conclusion, because every sweep this codebase has written was wrong at least once in a way that flattered the finding, and under-claiming an obligation costs a real person while over-claiming one costs us a line on a page.\n\nSo: the page states plainly that a representative is required and is not appointed. Appointing one is a small recurring cost and therefore the founder's call — it is the only one of the five that got MORE urgent when measured instead of assumed.","trigger":"already fired: representative_basis()['basis_holds'] is False, measured against the live account census rather than diarised"},{"id":"attestations","state":"deferred","as_of":"2026-09-13","decided_by":"coordinator","what":"There is no SOC 2 report and no third-party penetration test. Neither has ever been claimed, and both are stated plainly rather than omitted.","question":"Do we fund a penetration test and/or a SOC 2 programme?","decision":"NEITHER NOW, and they are two different answers wearing one question. SOC 2 is a programme priced for enterprise procurement and it certifies process, not code; buying it before an enterprise buyer exists is buying a document nobody has asked to read. A penetration test is cheaper and finds real defects — but our own adversarial security self-audit already found ten-plus real bugs that a 690-test suite missed, and it is repeatable at no cost. So the substitute is not 'nothing': that audit becomes a REQUIRED gate before any custody or key-handling sign-off, rather than a thing somebody thinks to run. The page keeps saying plainly that there is no SOC 2 and no pentest, because a self-audit is not one and must never be described as one.","trigger":"pentest: first paid business customer, or any custody/key-handling change we cannot self-audit · SOC 2: the first enterprise prospect who asks in writing"},{"id":"mistral-opt-out","state":"owner-action","as_of":"2026-09-13","decided_by":"coordinator","what":"Mistral trains on input and output subject to an account-level opt-out that exists and that we have not exercised. It is a setting in their console, not something this code can flip, and exercising it would move every model we route there from 'trains on your text' to 'does not'.","question":"Do we exercise Mistral's account-level training opt-out? Once it is flipped, set `data_policy.trains_on_data: false` for mistral in infra/sources/catalog.json with the date and a note — the receipt, the router and this page then move together.","decision":"YES — it is free, it is reversible, and it strictly widens the lane that can serve a customer who asked not to be trained on. There is no argument on the other side. It is filed as an OWNER ACTION rather than done, because it lives behind a login this code cannot and must not reach: we never touch a console on somebody's behalf. Until it is flipped and dated, the published answer stays 'trains on your text', because a decision to opt out is not an opt-out.","trigger":"owner flips it in the Mistral console, then dates the catalogue field"}],"representative_basis":{"article":"GDPR Article 27(2)(a)","basis_holds":false,"representative_required":true,"limbs":{"occasional":{"holds":false,"measured":1,"how":"accounts that are not ours, by the same predicate the operator's roster uses. Zero means the only traffic is our own, which is occasional by any reading."},"no_large_scale_special_category":{"holds":true,"how":"we collect no special-category or criminal-offence data as a controller, and content declared private is fenced to the customer's own machines and never reaches a third party at all."},"unlikely_to_risk_rights":{"holds":true,"how":"routing text to a model on the customer's instruction, with no profiling, no automated decisions about people, and deletion on request. This limb is a position we are recording, not a measurement, and it is the one an authority would test first."}},"says":"An Article 27 representative is REQUIRED and is not yet appointed. The Article 27(2)(a) basis we previously recorded no longer holds, because the processing is no longer occasional."},"how_this_is_made":"Generated from the running service every time you ask, not from a document somebody remembers to update. Retention and training come from the same code that signs every answer's receipt, so this page and your receipts can never disagree."}