Security

Opper is built for teams that need real compliance. Security covers both planes. The AI Gateway decides where calls can go at request time, and the platform is how everything underneath is hosted and protected. This page covers both.

​

EU-hosted by default

The platform runs only in AWS Stockholm. Traces, routing tables, scoring history, and metadata stay in the EU. The one thing that leaves Opper’s footprint is the model call itself, and you can constrain even that at the gateway. Use model access rules to:

• Restrict calls to EU-only providers (Mistral, Azure EU, and others)
• Pin specific regions or countries that calls can route to
• Set provider data requirements, including the Zero data retention policy

The gateway rejects anything that violates these rules before it leaves the platform.

​

We don’t train on your data

Opper never uses customer data to train models, and never shares it with providers for training.

​

Configure Opper storage and provider data requirements

Opper trace storage is controlled by Opper retention. With no applicable enabled retention rule, Opper records usage metadata but does not store traces. With tracing on, spans, inputs, and outputs are kept for the effective retention period, up to 30 days. Check your organization’s saved rules rather than assuming every project starts without tracing. For workloads that need both zero-day Opper retention and provider data restrictions, configure both settings in Rules:

1. In Opper retention, switch tracing off so the organization has an enabled 0-day retention rule. If the toggle already shows Off because the organization rule is missing or disabled, turn it on and then off in the draft before saving. New calls do not store traces, and projects cannot override that rule with a longer period. Usage records are still retained; existing traces keep their original expiry dates.
2. In Model access, select the provider data policy and requirements your calls must meet, such as Zero data retention. These settings filter which models your calls can use based on provider data handling.

Neither setting configures the other: turning Opper tracing off does not restrict providers, and selecting a provider data policy does not turn Opper tracing off. See Opper retention for zero-day retention’s effects on files and response caching.

​

One sub-processor for every model

Most AI vendors require a separate DPA amendment for every model provider you turn on. Opper doesn’t. Opper is your one AI sub-processor, so you can add or remove models without rewriting contracts.

​

Platform sub-processors

​

Model providers (you pick which to enable)

Enable only EU providers with a model access rule and no customer content ever leaves the EU.

​

Encryption

• At rest: AWS RDS with KMS-managed keys. Uploaded files use S3 SSE-S3.
• In transit: TLS on every public endpoint.
• Backups: encrypted in AWS Backup. Daily snapshots kept 5 weeks, weekly snapshots 14 months. Only Opper engineers can restore.

​

Data isolation

Each organization’s data is isolated at the application layer. Uploaded files live in a private S3 bucket with objects segregated per organization. Service-to-service traffic is restricted to a private AWS VPC.

​

Deletion

• Delete a project → all associated traces and events are removed.
• Set Opper retention to 0 → new calls do not store traces. Existing traces keep their original expiry dates.
• Uploaded files persist until you delete them (DELETE /v3/files/{id}, or an expiry you set). Scopes with an enabled 0-day Opper retention rule can’t hold files: uploads are rejected, and existing files are scheduled for permanent deletion after you confirm the file count and save. A provider data policy in Model access does not trigger file deletion by itself.

​

DPA and contact

Standard DPA and Standard Contractual Clauses are available on request. Contact hello@opper.ai.

• Full DPA: opper.ai/data-processing-agreement
• Sub-processors list: opper.ai/sub-processors

​

Controls that put this in your code

​

Models

See which models you can reach, and which ones are EU-hosted.