Maximum privacy
GDPR-compliant and EU AI Act ready, with full data sovereignty in the EU.
Privacy isn't a mode you switch on. It's how Kontinent is built. Requests are served from the EU, Kontinent never retains prompts, and you keep full data sovereignty without compromising on model choice or performance.
GDPR-compliant
Built to meet the requirements of the GDPR (DSGVO) end to end.
EU AI Act ready
Aligned with the obligations of the EU AI Act.
EU data sovereignty
Requests are served from EU regions.
Zero prompt retention
Zero prompt retention is a design contract, not a setting. Request and response bodies are never persisted or logged anywhere in the pipeline, checked by an end-to-end test that fails CI if a prompt reaches the gateway or worker logs.
Only metadata survives a request:
- Token counts (prompt, cached, completion)
- Latency and status
- Requested model, the model and provider that served it, and computed cost
- The API key and, if you send one, your own end-user id from the
userfield
The full list is on Privacy & retention.
None of it contains your prompt or the model's output. Because of this, the gateway cannot replay a prompt: there is no server-side history of your inputs or outputs. See Privacy & retention.
Privacy settings in the console
The Privacy page in the console turns these commitments into rules for your whole organization. Each switch applies to every key, and a key's own guardrail can make it stricter but never looser.
| Switch | Effect |
|---|---|
| Require zero data retention | Only providers with a contractual zero-retention commitment (zdr: default) receive requests. |
| Require no-training commitment | Only providers that contractually exclude training on your data receive requests. |
| Sovereign providers only | Only providers rated strict receive requests. EU regions of US hyperscalers do not qualify. |
| § 203 StGB providers only | For professionals bound by secrecy, such as law firms, tax advisors and physicians. Only providers that have signed a confidentiality undertaking under § 203 StGB receive requests. |
The page also lists every provider with its commitments and shows how many providers and models remain available with your settings. If a request asks for a model whose providers are all ruled out, it fails with 403 model_access_blocked and the message names the rule. If another route of the same model qualifies, the request is served there instead. For an organization registered for § 203, the refusal is 403 segment_not_permitted.
If your organization is registered as bound by professional secrecy, Kontinent support switches on the § 203 rule for you and it stays on. Contact support to register or to change that.
Sovereignty you can enforce
Every model declares a sovereignty tier, and you decide how strict your data residency needs to be: for the whole organization on the Privacy page, or per key with a guardrail. There is no request parameter that loosens it.
| Tier | Meaning |
|---|---|
strict | An EU-owned provider that Kontinent rates as sovereign. |
pragmatic | Served from the EU, but by a provider with a non-EU parent or one that runs on third-party cloud infrastructure. |
The tier is returned on every model from GET /v1/models, so you can require strict where the use case demands an EU-owned provider and allow pragmatic elsewhere. See Models & sovereignty.
No compromise
Full model choice
Many open-weight models are offered by sovereign providers too. A strict setting does shrink the pool, though: Claude, GPT and Gemini run only at pragmatic providers. The console shows what remains available before you switch.
Full performance
Residency constrains the pool, it does not pin you to one model. The smart router still classifies and routes among the models you allow. See Price & performance.