kontinent / trust center
Security & Compliance
Kontinent operates an AI gateway hosted in Frankfurt with EU-configured inference endpoints. Kontinent itself does not persist prompt or response content in the standard gateway; provider-side retention and third-country exposure vary by service and are disclosed separately.
17
Providers reviewed
14
Publicly rated
16
Review criteria per provider
0
Prompts stored by Kontinent
What happens to a request
Client
Kontinent Gateway
Frankfurt · eu-central-1
EU provider
Not persisted by Kontinent
- Prompt content
- Response content
Stored (metadata)
- Token counts
- Latency
- Status code
- Model/provider
Zero retention, tested
Our end-to-end suite sends marked test prompts (a sentinel value) through the Kontinent stack and then checks gateway and worker logs for it. If the sentinel appears there, the test fails. This verifies Kontinent's logging behaviour; provider-side retention is governed by the disclosed provider terms.
Compliance
Controls
Data minimization
No prompt logging
Kontinent does not persist prompt or response content in the standard gateway and does not design usage records, the audit log, or routine server logs to contain it. Any inference-provider retention is disclosed separately.
Usage data is metadata only
usage_records holds billing and operational metadata such as time, model/provider, token counts, cost, status, latency, routing, and key identifiers, not prompt or response content by design.
Prunable raw records
Usage records can be removed under the deletion policy; aggregates and the credit ledger carry the durable billing information.
Traceability
Organization-scoped audit log
Selected control-plane changes, including sign-ins, key creation/revocation, and credit movements, are recorded in the audit log. Retention can be configured by organization.
Append-only credit ledger
All balance movements flow through ledger_entries with a unique idempotency_key, so double-booking is structurally impossible.
Per-org audit view
Every organization sees its own audit trail at /audit in the dashboard.
Tenancy separation & access
Logical organization separation
Each request is assigned by organization and API key; server-side authorization checks and isolation tests protect other organizations' data.
API key auth with rate limits
Each key can carry its own RPM limit; authentication uses SHA-256 hashes. Plaintext is shown only when the key is created.
Audited key handling
API key creation and revocation are logged and traceable in the audit log.
EU infrastructure
Core platform in Frankfurt
The gateway, console, and production database run in AWS eu-central-1 (Frankfurt). Other providers and data flows are disclosed in the DPA.
EU providers only
Requests are routed exclusively to inference providers hosted in the EU.
Documented provider review
Providers are assessed against contracts, retention, data residency, subprocessor chain, and security evidence; open points are disclosed in the Compliance Index.
How we vet providers
- 01
Collect documents
Terms of service, DPAs, and certificates are gathered systematically.
- 02
Full-text review & clarifying questions
Every document is read in full; open points go back to the provider as clarifying questions.
- 03
Contractual evidence, not website claims
Only what's backed by contract clauses or written commitments is scored, not marketing copy.
- 04
Ongoing review with dated snapshots
Every rating carries a review date and is re-checked whenever something changes.
Provider Compliance Ranking
Every provider in the Kontinent catalog, rated on publicly verifiable compliance facts: six dimensions, tiers A–E, an open methodology, and a source citation for every rating.
View full rankingFAQ
Where is my data processed?+
The Kontinent gateway runs in AWS eu-central-1 (Frankfurt); requests are routed exclusively to providers hosted in the EU.
Are my prompts stored?+
Kontinent itself does not persist prompt or response content in the standard gateway. Billing and operational metadata is stored. Depending on their terms and service, some inference providers may retain content temporarily, in particular for abuse monitoring; details are in the Compliance Index and DPA.
Is my data used for training?+
Kontinent does not use customer content to train its own models. Whether an individual provider contractually commits to a training exclusion varies by provider; see the Compliance Index for the per-provider assessment.
How are providers vetted?+
Providers are reviewed against terms, DPAs, data residency, retention, subprocessor chains, and available security evidence. Open or only partly substantiated points are disclosed in the Compliance Index.
What certifications does Kontinent hold?+
ISO/IEC 27001 certification is in preparation, and SOC 2 Type II is on the roadmap. Kontinent is not currently certified to either standard; an Art. 28 GDPR DPA and a versioned TOM annex are available.
How do I report a security issue?+
Email security@kontinent.ai or follow the details at /.well-known/security.txt.
Service providers & subprocessors
Providers that may process data for platform operations, Kontinent's own contractual purposes, or inference. The DPA sets out the exact roles, data categories, and transfer mechanisms.
| Service provider / subprocessor | Purpose | Location / ZDR |
|---|---|---|
| Amazon Web Services (AWS) | Hosting & infrastructure | EU (eu-central-1, Frankfurt) |
| Stripe | Payment processing | EU / USA (SCCs) |
| PostHog | Technical logs and error diagnosis; product analytics only with consent | EU (Frankfurt) |
| Google Cloud EMEA Limited (Google Workspace) | Incoming privacy, contact, and support communications | EU/EEA; possible third-country access under GDPR Chapter V |
| Mistral La Plateforme | AI model inference (EU) | EU · ZDR (partial) |
| OVHcloud AI Endpoints | AI model inference (EU) | EU · Zero Data Retention |
| Regolo AI | AI model inference (EU) | EU · Zero Data Retention |
| Infercom | AI model inference (EU) | EU · Zero Data Retention |
| Scaleway Generative APIs | AI model inference (EU) | EU · ZDR (partial) |
| AWS Bedrock (EU Irland) | AI model inference (EU) | EU · ZDR (partial) |
| AWS Bedrock (EU Frankfurt) | AI model inference (EU) | EU · ZDR (partial) |
| AKI.IO | AI model inference (EU) | EU · Zero Data Retention |
| Nebul | AI model inference (EU) | EU · Zero Data Retention |
| Google Vertex AI (EU) | AI model inference (EU) | EU · Zero Data Retention |
| IONOS AI Model Hub | AI model inference (EU) | EU · Zero Data Retention |
| Azure OpenAI (EU Data Zone) | AI model inference (EU) | EU |
| Nebius Token Factory | AI model inference (EU) | EU · ZDR (partial) |
| TensorX | AI model inference (EU) | EU · Zero Data Retention |
| Inceptron | AI model inference (EU) | EU · Zero Data Retention |
Documents
We provide further evidence (e.g. TOM annex, provider DPAs, certification confirmations) on request: security@kontinent.ai.
Report a security issue: security@kontinent.ai or /.well-known/security.txt.