ZDR Provider Scorecard
Published 2026-09-24 (v1) · All sources accessed 2026-09-24 (UTC) · Versioned & dated
Verification status: single-snapshot verification, all sources accessed 2026-09-24 (UTC). Daily re-verification automation = policy-watch v0, task #1713 — live since 2026-10-12 (manual baseline run 00:45:36Z UTC; first unattended fire 06:45:59Z UTC verified green — 12/12 URLs clean, 0 changes, 0 fails, feed rolled from baseline; public status feed: latest-status.json). This page does not yet claim “checked daily” — that claim follows a proven daily cadence.
0. Honesty rules — this scorecard's contract with the reader
- Provider-ZDR ≠ gateway-ZDR ≠ unknown. Provider rows describe the provider's own posture. DESIGN-R's gateway posture is a separate section (§3). We never blend them.
- Every cell is dated and source-linked. Verbatim research reports are pinned per provider (see §5).
- UNKNOWN is a first-class verdict. Where a provider doesn't publish, we say UNKNOWN — we do not infer from third-party claims.
- “Listed” means we route our own traffic through it. Providers marked ✅ in the Listed column carry DESIGN-R production traffic today (roster-verified 2026-09-24). This is the practical meaning of the scorecard: we eat our own cooking.
- We verify and disclose; we do not control upstream. Providers can change terms at any time. The scorecard is a snapshot + a watching process, not a guarantee. Corrections policy: errors are corrected loudly and versioned, not quietly (§4).
- Vendor self-attestations are labeled as such and scored conservatively (treated as UNKNOWN until independently verifiable).
1. The rubric — 4 layers + carve-outs
Framework: ExecuteML Aug-2026 ZDR layers, applied per provider API product (not consumer chat apps).
| Layer | Question | Verdicts |
|---|---|---|
| L1 No-persistence | Does the provider retain prompts/outputs after the response? | PASS (no retention, disclosed bounded carve-outs allowed) / PARTIAL (default retention with opt-in ZDR or partial coverage) / FAIL (default retention, no ZDR path) / UNKNOWN |
| L2 No-training | Is customer content used to train models? | PASS (contractually excluded) / PARTIAL (opt-out required, or carve-outs) / FAIL (default training) / UNKNOWN |
| L3 No-human-review | Do humans review prompt/completion content? | PASS (documented automated-only) / PARTIAL (review only for flagged content) / FAIL (documented routine human review) / UNKNOWN |
| L4 No-jurisdiction-exit | Can data stay in a specified jurisdiction? | PASS (residency selectable) / PARTIAL (limited pinning or uplift-gated) / FAIL (no control) / UNKNOWN |
| Carve-outs | Prompt caching, abuse/fraud logs, batch/files APIs, stateful products | Each disclosed separately with retention windows, listed per row |
Gateway-ZDR (the DESIGN-R lane) is scored separately in §3 — same rubric, applied to us.
2. Provider matrix (provider-ZDR only)
2.1 Fireworks AI — serverless open models
Listed: ✅ city production lane| Layer | Verdict | Evidence (accessed 2026-09-24) |
|---|---|---|
| L1 | PASS w/ disclosed bounded carve-outs | ZDR by default for open models on serverless: “does not log or store prompt or generation data… without explicit user opt-in” (docs.fireworks.ai/guides/security_compliance/data_handling). Disclosed carve-outs: prompt data + KV caches may persist in volatile memory for minutes; Response API store=True default retains conversation data 30 days (opt-out via store=False; immediate DELETE by response_id) |
| L2 | PASS (open models) | same page; training on open-model traffic not claimed by provider |
| L3 | UNKNOWN | audit_logs page = customer-facing account audit logs (Enterprise feature), not staff review of prompt content; no statement found |
| L4 | PARTIAL | “US-only Serverless Deployments” product mode exists (region pinning); EU residency unstated |
| Carve-outs | — | KV-cache volatile minutes; FireOptimizer = explicit opt-in logging (disclosed exception); Response API default-on 30-day retention |
| Certs | — | HIPAA / SOC 2 Type 2 / GDPR claimed (fireworks.ai/enterprise); trust.fireworks.ai trust center |
| Notes | — | Anthropic sub-processor with ZDR agreement. Proprietary-model coverage: UNKNOWN (page scopes ZDR to open models). |
2.2 Cerebras Inference (cloud API)
Listed: ❌ candidate — not currently routedNo Cerebras lane carries city production traffic today (roster 2026-09-24: live lanes = ollama-city, ollama self-hosted, fireworks, opencode). Candidate status: ZDR-default posture is the strongest un-routed hosted candidate; scoring precedes any routing decision.
| Layer | Verdict | Evidence |
|---|---|---|
| L1 | PASS (default provider-ZDR) | Privacy Policy §6 + support KB: prompt content/API requests/responses not retained. Carve-outs: prompt cache (ephemeral in-memory, TTL 5min–1h, org-scoped, “fully ZDR-compliant” per docs); Batch/File APIs 7-day retention (private preview). Residual-log retention window: UNKNOWN (“no longer necessary” only) |
| L2 | PASS | Terms: no right to train/fine-tune on Service Content; policies FAQ confirms |
| L3 | UNKNOWN | No published human-review statement; terms reserve enforcement/legal-process use |
| L4 | PARTIAL | US + possibly other countries; SCCs; subprocessor list gated |
| Certs | — | SOC 2 Type 2, GDPR, CCPA (trust.cerebras.ai); ISO 27001 / HIPAA: UNKNOWN |
| Program | — | No named ZDR program (ZDR posture = default); Dedicated Endpoints = enterprise surface; DPA gated behind Trust Center request |
2.3 Mistral AI (la Plateforme/Studio API)
Listed: ⚠️ conditional| Layer | Verdict | Evidence |
|---|---|---|
| L1 | PARTIAL | Default: 30 rolling days abuse-monitoring retention. ZDR opt-in exists — request-based, discretionary, paid plans, stateless calls only (chat/FIM/embeddings/moderations/classifications/OCR/audio); excludes Agents, Batch, Conversations, Libraries, Files, Vibe. Prompt caching × ZDR interaction: UNKNOWN |
| L2 | PARTIAL | API training excluded by default w/ opt-out toggle; Labs/Preview models train regardless (ZDR does not apply to Labs); thumbs-up/down feedback always used for training |
| L3 | UNKNOWN | Automated monitoring primary; human review retained “where required by law”; no general opt-out documented |
| L4 | PASS-leaning | EU default hosting; opt-in US endpoint; SCCs; public subprocessor list (trust.mistral.ai) |
| Certs | — | SOC 2 Type II, ISO 27001:2022 + 27701:2019, HIPAA doc, pentest report (trust.mistral.ai); HDS: UNKNOWN |
| Partner tracks | — | Categories only (Strategic/Ecosystem/Integration); no published tier requirements: UNKNOWN |
Conditional-listed note: would be ✅ only with ZDR activated per-request and Labs models avoided; default posture is not ZDR-clean. We do not currently route city traffic here.
2.4 Open-weight self-hosted lane (GLM / DeepSeek / Kimi / Llama / Mistral weights)
Listed: ✅ we operate the stack| Aspect | Verdict | Evidence |
|---|---|---|
| Weights | PASS | Inert data files; no phone-home provision in licenses. License texts read at source (HF/GitHub raw, 2026-09-24) |
| License notes | — | GLM-5.3-Flash MIT; GLM-5.3 full bespoke (>US$10B MaaS revenue → Z.ai security review); DeepSeek V4 MIT; Kimi K2.6 modified MIT (branding >100M MAU / >US$20M mo); Kimi K3 bespoke (>US$20M MaaS → separate agreement); Llama 4 Community License (“Built with Llama” branding; >700M MAU → separate Meta license); Mistral Small 3.2 Apache 2.0 (lineup license-diverse — verify per-model) |
| ZDR risk surface | — | Serving-stack telemetry (vLLM anonymous usage stats — documented, opt-out via VLLM_NO_USAGE_STATS=1/DO_NOT_TRACK=1) + operator-side artifacts (request logs, monitoring, KV-cache config) |
| Verdict | Operator-achievable ZDR | The retention story is ours to configure and verify, because we run it. COGS ≈ 0 on owned hardware |
| UNKNOWN | — | Reference-stack telemetry for GLM/DeepSeek/Kimi/Meta; KV-cache persistence per deployment; SGLang/Ollama telemetry behavior |
2.5 Frontier providers (contrast rows)
Listed: ❌ default postures| Provider | L1 | L2 | L3 | L4 | Why not listed |
|---|---|---|---|---|---|
| Anthropic (Claude API) | PARTIAL | PASS | PARTIAL/UNKNOWN | PARTIAL | ZDR is sales-gated and unexecuted by us; default posture retains 30 days. (Also the founding reason for our provider-agnostic design: 2025 privacy-terms shift + external-harness ban.) |
| OpenAI (API) | PARTIAL | PASS | PARTIAL | PARTIAL | Sales-gated ZDR unexecuted; stateful products (conversations/chatkit/threads) not ZDR-eligible |
| Google (Vertex AI / Gemini API) | PARTIAL/FAIL-leaning | FAIL free tier | FAIL-leaning | PARTIAL | Free tier trains; paid tier ZDR requires multiple opt-outs + un-disablable logging carve-outs |
Frontier layer detail (per-provider evidence)
| Provider | Layer detail (evidence accessed 2026-09-24) |
|---|---|
| Anthropic | L1: default 30-day purge; ZDR opt-in via sales, per-org; covered models (Fable 5/5.1, Mythos 5/5.1) not ZDR-eligible; flagged content ≤2yr. L2: no training on customer content. L3: flagged-content review ≤2yr; unflagged policy UNKNOWN. L4: US-only inference opt-in (1.1x); workspace geo us-only. Sources: privacy.claude.com/en/articles/7996866; platform.claude.com docs; anthropic.com/legal/commercial-terms |
| OpenAI | L1: default ≤30-day abuse logs; ZDR + Modified Abuse Monitoring opt-in via sales; store=false forced under ZDR; videos blocked. L2: no training unless opt-in. L3: default monitoring may include human review; MAM carve-out; CSAM-suspect inputs retained even under ZDR. L4: per-project residency (10% uplift); system data excluded. Sources: developers.openai.com/api/docs/guides/your-data; trust.openai.com |
L1: ZDR conditional, not a toggle: advanced-model logging may be mandatory; grounding logs 3–30 days cannot disable (some modes); Interactions store=true default. L2: PASS paid / free tier trains on prompts+responses with human reviewers. L3: documented automated + manual review; 55-day abuse retention (Gemini API). L4: jurisdictional endpoints (US/EU; UK/CH excluded from EU); Gemini API paid: transient storage in any country. Sources: docs.cloud.google.com/gemini-enterprise-agent-platform/resources/zero-data-retention; ai.google.dev/gemini-api/terms |
Frontier certifications (context, not scored): OpenAI SOC 2 T2 + ISO 27001/17/18/27701 + 42001 + FedRAMP 20x; Google Cloud ISO family + SOC 1/2/3 + FedRAMP + HIPAA-supporting; Anthropic HIPAA BAA + ISO 27001 + 42001 + SOC 2 I&II (FedRAMP unconfirmed on official pages).
2.6 Providers with insufficient verified evidence
Listed: ❌ for now| Provider | Status | Note |
|---|---|---|
| Z.ai (GLM provider-hosted) | UNKNOWN-leaning | DPA §4(b) self-attestation: content “processed in real-time… not saved on our servers” — vendor self-attestation, not independently verified; consumer service discloses training on user data. Scored UNKNOWN until verified (rule 6) |
| DeepSeek (provider-hosted) | UNKNOWN | Primary ToS/privacy pages unreachable during research (2026-09-24); third-party ~30-day claims NOT verified — not cited |
| Moonshot/Kimi (provider-hosted) | UNKNOWN | No public retention terms located 2026-09-24 |
| Meta (hosted API) | UNKNOWN | First-party hosted-API data terms not verified this session |
| Ollama Cloud (ollama-city lane) | NOT YET SCORED | This is our primary city lane — its terms have not yet been verified against primary sources this cycle. Explicit gap; queued for next refresh. We list it here rather than silently omitting it. |
3. Gateway-ZDR — DESIGN-R's own posture
Same rubric, applied to us.
| Layer | Verdict | Basis |
|---|---|---|
| L1 No-persistence | PARTIAL — disclosed | City gateway runs on our own self-hosted infrastructure. Invocation transcripts and operational metadata are retained on city infrastructure (self-hosted Postgres) for operations and debugging — retention windows and redaction state pinned in the public data-handling statement (live 2026-09-24). Prompt content is forwarded to the listed provider only. |
| L2 No-training | PASS | No training on client data, contractual and operational. |
| L3 No-human-review | PARTIAL — disclosed | The operator and authorized city instances can inspect transcripts for operations/support. Disclosed, not hidden. |
| L4 No-jurisdiction-exit | PASS | Self-hosted city infrastructure; provider choice per client (ZDR tier = routed only through ✅-listed lanes). |
ZDR service tier (planned, doc #7287 §4 Q6): routed only through ZDR-pass lanes; daily attestation (policy-watch v0 live since 2026-10-12; first run 00:45Z, 12/12 clean); ≤24h disclosure on detected upstream change; optional provider pinning. Not yet live — copy after demand memo.
4. Change history & corrections policy
| Version | Date | Change |
|---|---|---|
| v1 | 2026-09-24 | Initial publication. 10 provider/lane rows + gateway section. Sources: #7334, #7335, #7336, #7337, Fireworks direct-fetch log 2026-09-24. Verification mode: single snapshot. |
| v1.1 | 2026-09-24 | Public page LIVE at https://design-r.ai/trust/scorecard/ (build: Tekton; source = this doc v2 verbatim, zero provider-fact edits; E2E incl. signup store-verified; build record #7341). /zdr-scorecard 301s to canonical. |
| v1.2 | 2026-10-12 | Doc-source §3 L1 status-line aligned to live state: data-handling statement live 2026-09-24 (https://design-r.ai/trust/data-handling/; #1714 completed 2026-09-24 22:51Z). Page already carried the correct claim since the v1.1 build (build-time correction); doc was stale. Zero provider-fact change; no page redeploy required. |
| v1.3 | 2026-10-12 | Header status-line receipt upgraded post-first-fire (Pheme 07:15Z verify seat): manual baseline 00:45:36Z + first unattended fire 06:45:59Z verified green (12/12 clean, 0 changes, 0 fails; feed rolled from baseline). "Checked daily" claim still withheld pending proven daily cadence. Zero provider-fact change; page redeploy queued with Tekton (#2252). |
Corrections policy: published errors are corrected loudly with a dated entry in §4. Provider-page changes detected by policy-watch v0 (#1713, live since 2026-10-12) generate change-log entries in §4.1 within one cycle of detection.
4.1 Provider change-log (policy-watch entries)
(No provider-change entries yet — policy-watch v0 first run completed 2026-10-12 00:45:36Z UTC, 12/12 URLs clean, 0 changes, 0 fails.)
5. Source reports
Provenance-pinned verbatim research harvests, all accessed 2026-09-24 (UTC). Full reports are retained internally with worker/invocation provenance; this page cites them by reference.
- Cerebras Inference — report #7334 (worker harvest, inv 82407, completed 14:25:28Z)
- Mistral AI — report #7335 (worker harvest, inv 82408, completed 14:27:04Z)
- Open-weight self-hosted lane — report #7336 (worker harvest, inv 82409; also bulletin #380)
- Frontier matrix (Anthropic / OpenAI / Google) — report #7337 (worker harvest, inv 82410, completed 14:27:08Z)
- Fireworks row — direct fetches 2026-09-24 (fact
fireworks_zdr_refresh_20260924); original datum 2026-09-21
All worker reports harvested verbatim; the fold adds only rubric mapping, verdict vocabulary, cross-links, and the gateway section — no provider-fact edits.
Get scorecard updates & the intelligence briefing
Scorecard updates, the daily compliance feed once it's live, and our intelligence briefing — you choose the frequency. Double opt-in, one-click unsubscribe, self-hosted end to end. We audit others' data handling; ours meets the same standard.