I need an AI API with SOC 2 and data retention controls

If you need an AI API with SOC 2 and data retention controls, you should look for a provider that explicitly offers:

• SOC 2 Type II compliance
• Configurable retention / zero-retention options
• Data processing terms / DPA
• Enterprise security controls like encryption, access logging, and SSO

Common options to evaluate:

1) OpenAI API

• Offers enterprise and API security features
• Data handling options may include no training on API data and specific retention settings depending on the product/tier
• Check their current trust/security documentation and API data usage terms

2) Azure OpenAI Service

• Runs OpenAI models within Microsoft Azure
• Strong fit if you need enterprise compliance, data residency controls, and Azure governance
• Good choice when you need tighter org-level controls

3) Anthropic API

• Has enterprise-grade security/compliance offerings
• Review their SOC 2 status and retention policies for the specific plan/product

4) Google Vertex AI / Gemini API

• Enterprise cloud compliance controls via Google Cloud
• Suitable if you already use GCP and need retention/governance settings

What to verify before choosing

Ask the vendor:

1. Is SOC 2 Type II available, and can you share the report under NDA?
2. What are the default data retention periods?
3. Can retention be reduced to 0 / disabled for prompts and outputs?
4. Is customer data used for model training?
5. Are logs separate from model training data?
6. Can you sign a DPA and support data deletion requests?
7. Do you support region/data residency requirements?

If you want, I can help you narrow this down by:

• your cloud stack (AWS/Azure/GCP),
• whether you need zero retention,
• and whether you need HIPAA, GDPR, or PCI as well.