Find Your Tool in 6 Steps
Result: 18

Archives: AI Tools

KIFOX - The Search Portal for AI Applications ?

Which AI tool is GDPR-compliant? Compare features, hosting, and data protection with real user reviews and an editorial score. Compare for free now.

Here, users can get an overview of which AI tools and LLMs are currently available on the market. Every user is free to submit a review and share their experience with AI applications, and can click a link to go directly to the provider’s website.

KIFOX is not an online store, but a comparison and information portal for AI applications.

Find Your Tool in 6 Steps Register ...
Results: 18
Search Images Video Music API Agent Voice Chatbot Coding Marketing
Provider login

Build with the latest DeepSeek models

DeepSeek currently offers two LLM access points via its API: deepseek-chat and deepseek-reasoner. According to the official documentation, both currently correspond to DeepSeek-V3.2 with a 128K context window; deepseek-chat stands for Non-Thinking mode, deepseek-reasoner for Thinking mode. The API is OpenAI-compatible and supports, among other things, JSON Output, Tool Calls, Chat Prefix Completion, and, in the case of deepseek-chat, additionally FIM Completion.DeepSeek API

LLM "Build with the latest DeepSeek models"

4.2/10 KIFOX Score – Limited
Other Token-based API usage Billing based on input, output, and cache-hit/cache-miss tokens.

deepseek-v4-flash Faster, more efficient model with Thinking and Non-Thinking mode, 1M context, JSON output, tool calls, and chat prefix completion.

deepseek-v4-pro More powerful model for more complex reasoning, coding, agents, and long contexts; also supports 1M context, JSON output, and tool calls.

OpenAI-/Anthropic-compatible API Usage via an OpenAI-compatible base URL or an Anthropic-compatible endpoint; suitable for existing SDKs and agent tools.

Open Weights / Self-hosting path DeepSeek-V4 was released as an open-weights family; self-hosting requires your own infrastructure and should be considered separately from the official API.
– (0)

Link

GDPR: No GDPR assessment: From a GDPR perspective, the DeepSeek API is critical for EU companies or only suitable after careful review.

Positive is that DeepSeek lists rights for EEA, Swiss, and UK users in its Privacy Policy, describes technical and organizational security measures, and states that it does not engage in targeted advertising, the sale of personal data, or automated decision-making that creates profiles with legally significant effects.

Negative is that, according to its Privacy Policy, DeepSeek collects, processes, and stores personal data directly in the People’s Republic of China. In addition, DeepSeek states that its purposes include, among other things, improving and developing the services as well as training and improving ML models and algorithms, including User Input. I was unable to reliably verify a publicly available GDPR DPA/AVV, SCC setup, or EU data residency offering in the official API documentation.

Server location: People’s Republic of China. Further link: DeepSeek Privacy Policy and API Docs.

DeepSeek Privacy Policy

Link

"co-create intelligence with everyone"

MiniMax is a multimodal foundation model provider with models for text, coding, agents, speech, video, music, image, and multimodal applications. Its products include MiniMax Agent, Hailuo AI, MiniMax Audio, Talkie, and an Open Platform for developers and enterprises.MiniMax

LLM “co-create intelligence with everyone”

6.1/10 KIFOX Score – Solid
Subscription Token Plan – Starter Subscription access for developers with access to MiniMax models via Token Plan API key; text models with a 5-hour rolling window, plan-dependent limited multimodal quotas.

Token Plan – Plus Expanded Token Plan with a higher M2.7 quota and additional daily multimodal quotas for Speech, Image, and other models.

Token Plan – Max Higher standard Token Plan with a larger request quota and expanded daily quotas for multimodal models.

Plus-Highspeed / Max-Highspeed / Ultra-Highspeed High-speed Token Plans with access to faster M2.7/M2.5 Highspeed models and expanded quotas for coding-related workflows. Other Pay-as-you-go API Standard Open Platform API key for usage-based billing according to actual consumption; supports text, video, speech, image, and additional modalities.

Audio Subscription / Video Packages Separate packages for speech and video generation with product-specific quotas and billing logic.

Local / Private Deployment Open M2 model weights can be run locally or privately via Hugging Face and frameworks such as SGLang, vLLM, Transformers, ModelScope, or NVIDIA NIM.
– (0)

Link

GDPR: Partly Overall assessment: Unclear to conditionally GDPR-suitable. MiniMax provides several services, including Open Platform/API, Agent, Audio, and Video; the official central privacy overview refers to product-specific privacy policies, including a separate Platform Privacy Policy for Enterprise API services.

Positive is that MiniMax provides a Privacy Policy for Agent/Web with data subject rights, deletion, correction, data portability, and opt-out rights for certain U.S. states, as well as additional information for Singapore residents.

Negative is that no verified information was found in the reviewed publicly accessible sources regarding an EU DPA/AVV, SCCs, EU hosting, complete subprocessors, or a clear no-training commitment for API customer data.

Server location: No verified server locations were found for the API/Open Platform in the reviewed sources; the Agent/Web Privacy Policy mentions Nanonoble Pte. Ltd. and additional information for Singapore, but this cannot automatically be applied to all API use cases. For GDPR-critical use, MiniMax API should only be used after direct clarification from the provider regarding AVV/DPA, data residency, training on customer data, subprocessors, retention, and deletion; alternatively, openly available M2 models can be evaluated locally or in a private cloud environment. Sources: MiniMax Privacy Overview, Agent/Web Privacy Policy, API Pricing/Docs, and official model/deployment notes.

Privacy Policy

Link

Anthropic offers current LLMs via the Claude API for language processing, reasoning, coding, agentic workflows, tool use, and document-centric tasks. According to the official model overview, all current Claude models support text and image input, text output, multilingual capabilities, and vision. For direct API access, Anthropic refers users to the Messages API; in addition, there are Managed Agents for longer-running tasks.Anthrophic Claude API Docs

LLM “highly performant, trustworthy, and intelligent AI platform”

7.1/10 KIFOX Score – Good
Free Anthropic documents that new users receive a small amount of free credits to test the API. However, this is not a classic permanent free plan in the SaaS sense, but rather a trial credit. Other Token-based Claude API Billing by model family such as Opus, Sonnet, and Haiku, as well as input, output, cache-write, and cache-read tokens.

Prompt Caching Reuse of large prompts, system instructions, or document contexts to reduce costs and latency. Batch API Asynchronous processing of large request volumes with a reduced billing model.

Long Context / 1M Context Available for certain current models; suitable for very large documents, codebases, and analysis contexts.

Data Residency / Third-Party Platforms Claude is also available via AWS Bedrock, Google Vertex AI, and Microsoft Foundry; regional pricing and data handling depend on the respective platform.
– (0)

Link

GDPR: Partly Anthropic provides a DPA with SCCs for commercial/API customers; according to the Privacy Center, this is automatically incorporated into the Commercial Terms.

For commercial services, Anthropic generally acts as a Processor on behalf of the customer according to the Privacy Center, and according to the Commercial Terms, Anthropic may not use Customer Content from the services for model training. In addition, according to the Privacy Center, inputs/outputs from commercial products such as the Anthropic API are not used for training by default, except, for example, in cases of explicit feedback/opt-in.

Also positive is the documented standard retention: for API users, inputs/outputs are deleted within 30 days according to the Privacy Center, unless, for example, the Files API, a different agreement, or ZDR applies. At the same time, the Privacy Policy mentions transfers to the USA or outside the EEA/UK for controller-side processing and refers to Adequacy Decisions or Standard Contractual Clauses.

For the direct Claude API, ZDR-capable features are also documented; the API documentation mentions Data Residency/inference geo-steering, though publicly, in the direct API context, mainly global or US-only. Broader regional routing/residency options are described primarily for AWS Bedrock, Vertex AI, and Microsoft Foundry. There is also a public subprocessor list as well as Trust Center artifacts for, among other things, SOC 2 and ISO 27001.

This means Claude is well documented for GDPR scenarios, but not automatically fully handled “out of the box” in every setup; especially with regard to data localization, tool usage, retention, and platform choice, the specific use case should be reviewed.

Privacy Policy Usage Policy

Link

OpenAI offers a broad range of models via the API for text generation, reasoning, coding, tool use, structured outputs, and document-centric workflows.

According to the official model overview, the current models support text and image input, text output, multilingual capabilities, and vision; they are available through the Responses API and client SDKs. For complex tasks, OpenAI recommends gpt-5.4 by default; for lower latency and cost, OpenAI points to gpt-5.4-mini and gpt-5.4-nanoOpen AI

LLM “Access our frontier models and APIs.”

8.0/10 KIFOX Score – Very good
Free There is a free usage tier in the API rate limit system for users in permitted geographies Other Token-based API usage Billing by model, input/output tokens, cached input, audio/image/tool usage, and other usage-dependent factors.

Batch / Flex / Priority / Scale Tier Options for controlling costs and latency for larger or plannable workloads.

Fine-Tuning / Evals / Tools / Agents Additional API features for customization, evaluation, agents, web search, file search, code interpreter, realtime, and structured outputs.

Data Residency / ZDR / EKM Enterprise-grade data controls with regional storage/processing, Zero Data Retention or Modified Abuse Monitoring, and external key management.
– (0)

Link

GDPR: Partly GDPR assessment: From a GDPR perspective, the OpenAI API is conditionally to well suited if it is used with Business/API contracts, a DPA, appropriate project settings, and clear data policies.

Positive is that, according to the API documentation, OpenAI has not used API data to train or improve its models since March 1, 2023, unless customers explicitly opt in. In addition, there is a Data Processing Addendum, abuse-monitoring retention of up to 30 days, Zero Data Retention or Modified Abuse Monitoring for eligible customers, Data Residency for multiple regions, and Enterprise Key Management.

Negative is that not all features are automatically ZDR-compatible, system data may be excluded from Data Residency, and for non-US regions additional approvals or ZDR/abuse-monitoring requirements apply.

Server location: By default, not automatically EU-only; Data Residency can be enabled on a per-project basis, including for Europe / EEA + Switzerland, whereby customer data can be stored regionally for supported endpoints and, in Europe, can also be processed regionally. Further link: OpenAI Data Controls / Your Data and OpenAI DPA.

Data controls in the OpenAI platform

Link

“Truly usable and practical AI”

Tencent Hunyuan is Tencent Cloud’s AI model family. It includes text models, reasoning models, vision, video understanding, image generation, translation, 3D generation, and open-source models. Tencent positions Hunyuan for content creation, mathematics, code, dialogue, enterprise scenarios, and multimodal workflows.Tencent Hunyuan / Tencent HY

LLM “Truly usable and practical AI”

4.3/10 KIFOX Score – Limited
Free Free Resource Package / Test Quota
Upon initial activation of Tencent HY Text Generation Global, a one-time free test quota is provided as a Resource Package; after it is used up or expires, postpaid activation is required. Other Token Postpaid / Pay-as-you-go API billing based on token consumption for Hunyuan text functions; billing via Tencent Cloud according to usage and with postpaid enabled.

Tencent HY 3D Global Separate product for 3D generation from text, image, or sketch with its own billing and API/cloud usage.

Enterprise / Tencent Cloud Agreements Individual cloud, contractual, and compliance setups are possible via Tencent Cloud; specific terms and data regions must be reviewed contractually.
– (0)

Link

GDPR: No Overall assessment: Conditionally to critically GDPR-suitable. For the EEA, UK, and Switzerland, Tencent Cloud designates Tencent Cloud Europe B.V. in Amsterdam as the Data Controller for administrative data and states that customer data or content is generally processed as a processor within the scope of the services.

Positive is that Tencent Cloud references a Data Processing and Security Addendum structure in the Privacy Policy, distinguishes roles between Controller and Processor, and offers formal contractual documentation for enterprise/cloud use.

Negative is that Tencent Cloud states in the Privacy Policy that servers may be located outside the user's country, for example in Mainland China. In addition, the AI Service Terms allow Tencent Cloud to use User Input and AI Output for the provision, support, improvement, development, and training of AI Models, unless an opt-out is made in the respective AI function. According to the AI Terms, sensitive personal data and specially regulated data must not be entered into AI Services unless this has been expressly agreed in writing and configured accordingly.

Server location: depending on the Tencent Cloud service and configuration; the official Privacy Policy mentions possible processing outside the user's country, including Mainland China. For GDPR-critical use, Tencent Hunyuan is therefore only recommended with a DPA, region/transfer review, training opt-out, subprocessor review, and exclusion of sensitive data. Sources: Tencent Cloud Privacy Policy, AI Service Terms, and Hunyuan documentation.

Privacy Policy

Link

Command A is Cohere’s most powerful enterprise LLM for real business tasks such as tool use, retrieval-augmented generation, agents, and multilingual workflows.

The model has 111 billion parameters, supports 23 languages, features a 256k context window, and according to Cohere is designed for a comparatively low inference footprint.Command A

LLM “Our largest, most performant model, ideal for building enterprise agents with a low compute footprint.” - “Max performance, minimal compute”

8.3/10 KIFOX Score – Very good
Free Yes, limited. Publicly primarily API/enterprise use; free trial or evaluation access may depend on the contract/account. Other API Usage Model access via the Cohere API, usage-based billing by model and tokens.

Enterprise / Private Deployment VPC, on-premises, or air-gapped deployment for companies with strict data protection, security, and data residency requirements.

North / Compass / Embed / Rerank Complementary Cohere products for agents, enterprise search, embeddings, and retrieval
– (0)

Link

GDPR: Yes GDPR assessment: Command A or Cohere is conditionally to well suited from a GDPR perspective, especially with an enterprise contract, DPA, and private deployment.

Positive is that Cohere documents enterprise data controls, DPA requests, security programs, and private deployments for VPC and on-premises. The hosting flexibility is particularly strong: Cohere can be operated in the customer's own private cloud or on-premises, allowing data residency and governance to be controlled more effectively.

Negative is that for public SaaS/API usage, specific server locations and training/data controls depend on the contract and deployment model; for enterprise usage, the DPA, training opt-out, retention, subprocessors, and region should be contractually reviewed.

Server location: For private deployment, freely selectable or controllable by the customer; for Cohere Managed Cloud, EU-only hosting cannot be generally guaranteed without a specific contract review. Further link: Cohere Privacy, Security, and Private Deployments.

Cohere Privacy Policy

Link

"Trustworthy artificial intelligence that powers humanity towards superproductivity"

AI21 Labs is an Israeli provider of large language models and AI orchestration systems for enterprises. Its core product in the model space is the Jamba family, a hybrid SSM/Transformer model family for long contexts, RAG, question-answering systems, document processing, and secure enterprise deployments. In addition, with Maestro, AI21 offers a model-agnostic orchestration system for validated RAG agents and complex business tasks.AI21 Labs

LLM "Trustworthy artificial intelligence that powers humanity towards superproductivity"

7.9/10 KIFOX Score – Good
Free New accounts receive time-limited trial credits for AI21 Platform, APIs, SDK, and Playground. Truly usable for testing, prototyping, and evaluation; billing or a paid plan is required for continuous production use. Subscription Pay As You Go: usage-based access to Foundation Model APIs, SDK, and unlimited seats.

Custom Plan: includes pay-as-you-go features plus volume agreements, premium rate limits, private cloud hosting, priority support, a dedicated account manager, and AI consulting. No direct prices listed. Other AI21 uses token-based API billing, custom payment/enterprise plans, and cloud provider billing through partners such as AWS, Microsoft Azure, Google Cloud / Vertex AI Model Garden, or SageMaker/Bedrock. Additionally, self-deployment, fine-tuning, quantization, and custom AI systems are relevant, depending on the contract and infrastructure. No direct prices listed.
– (0)

Link

GDPR: Yes Overall assessment: AI21 Labs is generally suitable for GDPR-compliant use, but it is not “automatically” unproblematic. A positive aspect is that AI21 provides a DPA/AVV upon request and classifies itself as a Processor/Service Provider for Customer Content. A critical point is that Customer Content and Outputs—unless otherwise contractually agreed—may be processed worldwide, including in Israel, the USA, the EEA, the UK, and other locations. For production use involving personal data, the AVV/DPA, hosting region, subprocessors, SCCs/transfer mechanisms, retention periods, and training exclusion should therefore be contractually reviewed.

Positive: AI21 Labs Ltd. is based in Israel; Israel is recognized by the European Commission as a country with an adequacy decision, meaning EU data transfers to Israel are generally possible without additional transfer safeguards. AI21 documents ISO 27001/27017/27018 and SOC 2 references, a DPA/AVV is available upon request, and AI21 states in the model terms that, unless otherwise agreed in writing, AI21 Models are not trained on Customer Content.

Negative: According to the Terms, Customer Content may be processed in Israel, the USA, the EEA, the UK, and other regions; for the USA/other third countries, subprocessors, SCCs, and specific region-lock commitments, the publicly reviewed sources do not provide complete verified details. Sensitive data and personal data are only intended for use with a solution that has been appropriately configured or approved.

Server location: Israel, USA, EEA, UK, and other locations are possible unless otherwise specified in the Order. For GDPR-compliant use, the AVV/DPA, hosting region, subprocessors, retention periods, training exclusion, and traceless operations should be contractually fixed.

A121 SOLUTIONS PRIVACY POLICY

Link

Inspiring AGI to Benefit Humanity - free AI chatbot & agent powered by GLM

Zhipu AI is a Chinese large language model provider that operates internationally under the name Z.ai. At its core is the GLM model family for text, reasoning, agents, coding, vision, OCR, image, video, and audio capabilities. The platform offers API access, coding plans, web search, Translation Agent, and Slide/Poster Agent.Zhipu AI / Z.ai – GLM

LLM "Inspiring AGI to Benefit Humanity - free AI chatbot & agent powered by GLM"

6.7/10 KIFOX Score – Solid
Free GLM-4.5-Flash / free quotas
Z.AI describes GLM-4.5-Flash as a free model variant for reasoning, coding, and agents; in addition, free trial quotas may be available depending on the platform status. Subscription GLM Coding Plan
Personally assigned coding subscription for officially supported coding tools; not intended for general API use, resale, or use by third parties. Other API Usage / Usage-Based Billing API access to GLM models, SDKs, OpenAI-compatible usage, streaming, function calling, structured output, context caching, and tool usage; billing is usage-based depending on the model and platform rules.

Enterprise / Individual Agreements Separate written agreements are possible; no confirmed information is available regarding standardized EU enterprise plans or EU hosting.
– (0)

Link

GDPR: Partly Overall assessment: Conditionally GDPR-suitable. For the international GLM/Z.AI platform, the official privacy policy names JINGSHENG HENGXING TECHNOLOGY PTE. LTD. in Singapore as the responsible entity; according to the policy, personal data is generally processed in Singapore.

Positive is that Z.AI describes a Data Processing Addendum for API services in which Z.AI acts as a processor for customer data, processes customer data according to instructions, and states that it does not permanently store content from API inputs/outputs.

Negative is that the general Privacy Policy for individual users provides for the use of data to improve and train the models, and explicitly allows international transfers outside the user's country.

Server location: according to the official policy, generally Singapore; no verified information is available on EU hosting, EU data residency, a complete list of subprocessors, or specifically designated Standard Contractual Clauses for EU customers. For GDPR-relevant use, Z.AI should therefore only be used with an API DPA, a clear review of international transfers, a deletion concept, risk assessment, and without sensitive personal data. Sources: Z.AI Privacy Policy and DPA for API services.

Privacy Policy

Link

Amazon Nova is Amazon's own family of foundation models for text, image/video understanding, document analysis, agents, tool use, and speech.

Nova is used via Amazon Bedrock APIs, in particular InvokeModel, InvokeModelWithResponseStream, Converse, ConverseStream, and, for Sonic, via bidirectional streaming.Amazon Nova API

LLM “frontier intelligence” - “industry-leading price-performance”

7.4/10 KIFOX Score – Good
Free AWS shows “Get started for free,” but for Amazon Nova/Bedrock, publicly documented billing is primarily usage-based; specific free quotas depend on AWS offerings, region, and account. Other On-Demand / Standard Tier Usage-based inference by model, modality, and tokens or image/video/special usage.

Flex / Priority / Reserved Tiers Bedrock supports different service tiers to manage cost, availability, latency, and throughput.

Batch Inference Asynchronous processing of larger workloads; according to AWS, cheaper than On-Demand for selected models.

Provisioned Throughput Reserved capacity for higher or predictable throughput; required for certain custom or production scenarios.

Fine-Tuning / Custom Models Customization using your own training/validation data; use of individual models typically via provisioned capacity.

Guardrails / Knowledge Bases / Agents / Prompt Routing Additional Bedrock features for security, RAG, agent orchestration, model routing, and governance.
– (0)

Link

GDPR: Yes GDPR assessment: Amazon Nova via Amazon Bedrock is well suited from a GDPR perspective if AWS contracts, DPA, region, IAM, logging, and cross-region inference are configured correctly.

Positive is that, according to AWS, Amazon Bedrock does not store or log prompts and completions, does not use them to train AWS models, and does not distribute them to third parties. According to AWS, model providers do not receive access to the Bedrock deployment accounts, logs, or customer inputs/outputs. In addition, Bedrock offers encryption in transit and at rest, AWS KMS, IAM, CloudTrail, PrivateLink, and compliance references including GDPR, ISO, SOC, CSA STAR, HIPAA Eligible, and FedRAMP High for AWS GovCloud.

Negative is that, under the shared responsibility model, the customer remains responsible for correct configuration, region, access rights, logs, tags, external data sources, knowledge bases, and cross-region inference.

Server location: Depends on the selected AWS region; with geographic cross-region inference, prompts/outputs can be processed within a geography such as the EU, while with global cross-region inference, data can be processed worldwide in supported commercial AWS regions. Further links: Amazon Bedrock Data Protection, Security & Privacy, Cross-Region Inference.

Data protection

Link

"Where knowledge begins"

Perplexity Sonar is a family of models for AI search, web-based answers, research, reasoning, and deep research. The API is particularly strong in current facts, citations, product comparisons, summaries, and research workflows.Perplexity Sonar

LLM “Where knowledge begins”

7.6/10 KIFOX Score – Good
– (0)

Link

GDPR: Yes Overall assessment: Conditionally to well suited for GDPR compliance for the Sonar API, depending on the contract.

Positive is that Perplexity states a strict Zero Data Retention Policy for the Sonar API: content from API requests is not stored and customer data is not used for model training. According to the API documentation, only necessary billing metrics are collected, such as token count, model used, timestamp, duration, and API key identification; according to Perplexity, this metadata does not contain prompt or response content. In addition, Perplexity mentions SOC 2 Type II, HIPAA Gap Assessment, and CAIQlite in the trust/security context.

Negative is that, according to the FAQ, Perplexity hosts its compute infrastructure via AWS in North America; for EU customers, this means a third-country/transfer assessment is required. No verified information is available in the evaluated sources about a publicly directly reviewed DPA/AVV or SCC document.

Server location: AWS in North America for language models/API according to the Perplexity FAQ. Conclusion: For API-based research and search applications, significantly more attractive from a data protection perspective than many LLM APIs, but for GDPR-compliant EU use, the DPA/AVV, transfer mechanism, subprocessors, and enterprise contract should be reviewed. Sources: Perplexity Privacy & Security, FAQ, and Enterprise Security information.

Privacy & Security

Link

xAI offers Grok models via its API for text generation, reasoning, coding, tool use, document-centric workflows, and agentic research. The current docs focus primarily on Grok 4.20 as the new flagship, as well as on server-side tools such as Web Search, X Search, Code Execution, and Collections Search.

Additionally, xAI documents classic model-listing endpoints such as /v1/models and /v1/language-models.xAI API – Grok

LLM “Build with Grok, the AI model designed to deliver truthful, insightful answers.”

7.4/10 KIFOX Score – Good
Other Token-based API usage Billing based on input, reasoning, completion, image, and cached prompt tokens per model.

Server-side Tools Additional billing for tool invocations; costs may increase with the complexity of agentic requests.

Credits / API Key API usage takes place via an xAI account, API key, and purchased credits.

Enterprise / ZDR Enterprise customers can use Zero Data Retention so that API requests and responses are not stored.

Voice / Imagine / Batch / Tools Additional product areas for real-time conversations, TTS/STT, image/video generation, batch processing, web search, and structured outputs.
– (0)

Link

GDPR: Partly GDPR assessment: From a GDPR perspective, the xAI API is conditionally to well suited if it is used in an xAI Business/Enterprise context with a DPA and appropriate data controls.

Positive is that xAI provides a Data Processing Addendum that addresses GDPR/UK GDPR/Swiss FADP, roles as Processor, SCCs, UK Addendum, subprocessors, and deletion after the end of the contract. xAI also states that it never uses API inputs and outputs for training without explicit permission; API requests and responses are stored by default for 30 days for abuse/misuse audits and then deleted. For Enterprise, there is Zero Data Retention, under which prompts, completions, and metadata are not persisted.

Negative is that xAI allows international transfers outside Europe, including to the USA, and there is no publicly confirmed EU-only data residency as the standard for the API.

Server location: No confirmed EU-only region as standard; the DPA mentions transfers/processing outside Europe, including the USA, insofar as necessary for service provision. Further link: xAI DPA, xAI API Security FAQ, and xAI Enterprise FAQ.

xAI Data Processing Addendum

Link

Google offers a family of models with the Gemini API for text generation, reasoning, coding, agent workflows, tool use, multimodal prompts, and document-centric processing.

For current API LLMs, Gemini 3.1 Pro Preview, Gemini 3 Flash Preview, Gemini 3.1 Flash-Lite Preview, Gemini 2.5 Pro, Gemini 2.5 Flash, and Gemini 2.5 Flash-Lite are particularly relevant. Older Gemini 2.0 Flash variants are still available, but are already marked as deprecated.Google Gemini API

LLM “AI for every developer”

7.3/10 KIFOX Score – Good
Free Free or unpaid use with limits; content may be used for product improvement and should not contain sensitive or confidential data. Other Gemini API Paid Tier For production applications with higher limits, context caching, Batch API, access to advanced models, and without using content for product improvement.

Batch / Context Caching / Priority / Flex Additional billing and operational options for controlling cost, latency, and throughput.

Vertex AI / Google Cloud Enterprise-oriented operation with Cloud DPA, IAM, regional endpoints, data residency, monitoring, and zero-data-retention configurations.

Grounding / Tuning / Embeddings / Live API Advanced features for search, context enrichment, model customization, vector search, real-time audio, and multimodal applications.
– (0)

Link

GDPR: Partly GDPR assessment: From a GDPR perspective, the Gemini API depends heavily on the usage path: Google AI Studio/Gemini API Free Tier, Paid Tier, or Vertex AI.

Positive is that Google states for Paid Services that prompts and responses are not used for product improvement and are processed in accordance with the Data Processing Addendum. For the Free Tier, however, the following applies: content and responses may be used to provide, improve, and develop Google products and ML technologies; human reviewers may examine API input and output, and Google explicitly warns against entering sensitive, confidential, or personal information into Unpaid Services. For the EEA/Switzerland/UK, the Gemini API Terms state: API clients for users in these regions may only use Paid Services.

Server location: For Gemini Developer API Paid Services, prompts/responses may be temporarily stored or cached in countries where Google or its agents operate facilities for safety/abuse detection; with Vertex AI, data at rest remains in the selected location, and ML processing takes place for supported models in the chosen region or multi-region. Further link: Gemini API Terms, Gemini API Pricing, and Vertex AI Data Residency.

Gemini API – Additional Terms Vertex AI and no data retention

Link

"Frontier intelligence, customized to you."

The Mistral API is the developer and enterprise interface for Mistral models.

Through Mistral AI Studio, companies and developers can use models via API, test prompts, build agents, implement RAG workflows, use fine-tuning, manage workspaces, and bill API usage. Mistral offers both open-weight and commercial/premier models.Mistral API

LLM - build, customize, and deploy AI, your way

8.3/10 KIFOX Score – Very good
Free Le Chat Free Personal AI assistant for chat, search, learning, images, projects, memories, and connectors; not to be equated with productive API usage. Other API / La Plateforme Usage-based API for Mistral models, chat, embeddings, OCR, agents, coding, multimodal models, and developer workflows.

Self-Deployment / Open-Weight Models Selected models can be operated independently or via cloud/enterprise deployments; the range of features depends on the respective model.

Enterprise Private Deployment Customized private deployment for organizations with increased control, security, and scalability requirements.
– (0)

Link

GDPR: Yes GDPR assessment: From a GDPR perspective, the Mistral API is well suited, especially for European companies.

Positive is that Mistral AI is a French company, provides a Data Processing Addendum, and clearly documents for the API that API data is not used for model training. In addition, Mistral states that data is hosted in the European Union by default; only when the US API endpoint is explicitly used is data hosted in the USA. Also positive are GDPR rights, DPA, SCCs for international transfers, subprocessor review, and the ability for Enterprise customers to disable certain features involving transfers outside the EU at the organization level.

Negative is that, depending on the feature, data may be temporarily transferred outside the EU to subprocessors and that feedback functions or certain products may have their own training/improvement logic.

Server location: European Union by default; USA when the US endpoint is explicitly used. Further links: Mistral Privacy Docs, Data Location Help, Mistral DPA.

Privacy

Link

Alibaba Cloud Qwen is Alibaba Cloud's LLM/multimodal model family. Through Model Studio / DashScope, developers can use Qwen models via API, including text models, multimodal models, reasoning models, coding models, translation models, and open-source/open-weight variants. The API is OpenAI-compatible and can be used via different endpoints depending on the region.Alibaba Cloud Qwen API

LLM “one-stop model service platform”,

7.4/10 KIFOX Score – Good
Free Free quotas for certain models/regions; Free Quota applies only to real-time inference and not to batch calls, context cache, fine-tuning, deployment, or custom models. Other Pay-as-you-go / Model Invocation Usage-based billing by model, input/output tokens, thinking/non-thinking mode, region, and deployment mode.

Batch Calls Separate processing of large workloads; not covered by the Free Quota.

Context Cache Cache function to reduce repeated context costs; not covered by the Free Quota.

Fine-Tuning / Deployment / Custom Models Model customization and deployment of proprietary or fine-tuned models; billed separately and not covered by the Free Quota.

OpenAI-/Responses-compatible API Qwen models support OpenAI-compatible interfaces and the Responses API for agentic applications.
– (0)

Link

GDPR: Partly GDPR assessment: Alibaba Cloud Qwen API / Model Studio is conditionally suitable from a GDPR perspective.

Positive is that Alibaba Cloud Model Studio officially states that it never uses data for model training and encrypts transmitted data when creating applications or training models. It is also positive that Alibaba Cloud provides GDPR information, a Data Processing Addendum, SCCs, and international data protection mechanisms. For the Qwen API, several deployment modes are documented, including EU with endpoint and data storage in Germany/Frankfurt as well as inference resources restricted to the EU.

Negative is that, depending on the mode, data may be processed in Singapore, the USA, China, Hong Kong, the EU, or in global deployment modes; the “International” mode stores the endpoint/data in Singapore but schedules computing resources globally excluding mainland China, while “Global” names the USA/Virginia or Germany/Frankfurt as the endpoint/storage location but schedules computing resources globally.

Server location: Depending on the selected deployment mode: International = Singapore with global scheduling excluding mainland China; US = Virginia; Chinese Mainland = Beijing; China Hong Kong = Hong Kong; EU = Germany/Frankfurt with EU-restricted inference. Further links: Model Studio privacy/training, Qwen API regions, Model Pricing/Deployment Modes, Alibaba Cloud DPA.

Alibaba Cloud International Website Privacy Policy

Link

“The AI community building the future.”

Hugging Face is not a single proprietary LLM provider, but a platform for hosting, discovering, distributing, evaluating, and deploying AI and LLM models. The Model Hub is used for storing, discovering, and using model checkpoints; LLMs can be used via Inference Providers, Inference Endpoints, or locally through libraries such as Transformers.Hugging Face

LLM “The AI community building the future.”

7.6/10 KIFOX Score – Good
Free You can test API access with a free Hugging Face account. There are monthly free credits. According to the current Hugging Face documentation, free users receive monthly credits, currently listed as $0.10, subject to change. After that, you need additional credits or pay based on usage. Subscription PRO With Hugging Face PRO, you get significantly more included inference credits. The pricing page lists, among other things, 20× included inference credits for PRO; the Inference docs currently mention $2.00 in monthly credits for PRO users.

Team & Enterprise For organizations, there are Team and Enterprise. These plans also include Inference Provider benefits or credits per seat and enable centralized billing, limits, and administration. According to Hugging Face, Team/Enterprise organizations currently receive $2.00 per seat in monthly credits. Other Pay-as-you-go If your credits are used up, you can continue making API requests by purchasing additional credits or paying based on usage. The costs depend on the specific model, provider, and usage.

Your own provider key In some cases, you can also use your own API keys from external providers. In that case, billing does not go through Hugging Face, but directly through the respective provider; according to the documentation, Hugging Face does not charge for this call.
– (0)

Link

GDPR: Partly Overall assessment: Conditionally GDPR-suitable. Considered purely as an LLM provider, Hugging Face is primarily GDPR-compliant when companies use Team or Enterprise features, a Data Processing Agreement, and a controlled infrastructure configuration. A positive aspect is that Hugging Face states for Inference Providers that it does not store user data for training purposes and, for routed requests, stores neither the request body nor the response; according to the documentation, debugging logs are retained for up to 30 days and contain no user data or tokens. In addition, TLS/SSL is provided for transmission, the Hub is SOC 2 Type II certified, and GDPR Data Processing Agreements are offered for Enterprise plans.

Negative is that Hugging Face functions as a router to multiple external AI inference providers for Inference Providers; for the specific data processing, Hugging Face explicitly refers to the privacy and security policies of the respective provider. As a result, a blanket GDPR assessment for all LLM models and providers is not possible. The general Privacy Policy also names Hugging Face, Inc. and servers in the USA; personal data may be processed in the USA or other countries. Third-party providers or subprocessors listed include AWS, Google Cloud Platform, MongoDB Atlas, Stripe, GitHub, OVHcloud, and Hugging Face SAS.

Server location: For the general service, Hugging Face lists servers in the USA; with Storage Regions, Team and Enterprise organizations can store repositories, models, datasets, and Inference Endpoints in EU data centers. However, for pure Inference Provider LLM calls, the actual processing location depends on the selected provider and its policies.

Conclusion: For GDPR-critical LLM use, Hugging Face is not universally “simply safe,” but with an Enterprise DPA, EU storage, dedicated Inference Endpoints, PrivateLink, provider review, and clear logging/retention, it can be well controlled. For personal or confidential data, no arbitrary Inference Provider should be used without separate review. No verified information is available for uniform GDPR compliance across all connected LLM providers.

Security & Compliance

Link

Llama is Meta's family of generative foundation models for text and, in part, image/text understanding.

Meta positions Llama as a flexibly deployable model series that can be fine-tuned, distilled, and deployed “anywhere”; this includes self-hosting, private cloud, and hosting through partners. Llama 4 brings native multimodality, while Llama 3.x continues to address important text, coding, translation, and agent use cases.Meta Llama

LLM “Industry Leading, Open-Source AI”

6.9/10 KIFOX Score – Solid
Free Llama model weights / Download Llama models can be downloaded, fine-tuned, distilled, and self-hosted under the Meta license; infrastructure costs for self-hosting are incurred separately.

Meta Llama API Preview / Waitlist The Llama API is officially positioned via waitlist/login; I could not reliably substantiate a permanently freely usable public API free version with guaranteed limits. Other Managed Llama API API access to current Llama models, API key, playground, SDKs, OpenAI-like integration, tool calling, and models such as Llama 4 Maverick/Scout according to the official Llama API page.

Self-hosting / own cloud / edge Operation of the model weights on your own infrastructure, with cloud providers, or locally; suitable for data protection, cost control, and individual optimization.

Cloud provider / third-party hosting Llama models are available through various cloud and inference providers; data protection, pricing, and server locations then depend on the respective provider.

Fine-tuning / distillation / Llama Stack Customization and integration into your own AI architectures, depending on the model license, infrastructure, and technical setup.
– (0)

Link

GDPR: Partly GDPR assessment: Meta Llama must be assessed in two parts from a GDPR perspective: The Llama models as downloadable/open-weight models can generally be operated in a very privacy-friendly way when self-hosted, because server location, logging, access control, and data flows can be controlled directly. The Meta Llama API, on the other hand, can only be assessed with limited clarity from a GDPR perspective, because not all details regarding the DPA/data processing agreement, EU data residency, and the specific API server location are transparently documented publicly.

Positive is that Meta explicitly states for the Llama API that API inputs and outputs are not used for training or improving the models, that data is not used for advertising/ad targeting, that role-based access controls are used, that API data is stored separately from other Meta product data, and that data is encrypted both in transit and at rest.

Negative is that, according to the official site, the Llama API still operates via waitlist/login and that no publicly fully verifiable EU DPA/server location details are freely available.

Server location: Freely selectable for self-hosting; for the Meta Llama API, it cannot be publicly verified as EU-only. Further links: Llama API, Llama models, Llama license/FAQ.

Privacy Policy

Link

"Seeking the optimal conversion from energy to intelligence"

Moonshot AI is the provider behind Kimi, an LLM and agent platform focused on long contexts, coding, deep research, documents, spreadsheets, slides, web search, and multimodal processing. The Kimi API offers models such as Kimi K2.6, K2.5, K2, and Moonshot-v1.Moonshot AI

LLM “Seeking the optimal conversion from energy to intelligence”

4.3/10 KIFOX Score – Limited
Other Pay-as-you-go API Flexible, usage-based billing according to input and output tokens, model selection, and, where applicable, document/tool usage; suitable for developers and small teams.

Kimi K2.6 / K2.5 / K2 / Moonshot V1 Model families for multimodal or text-based tasks, long context, coding, agents, reasoning, and dialogue tasks.

Enterprise Solutions & Customization For medium-sized and large companies with flexible rate limits, multi-project deployments, support, SLA-oriented reliability, and individual agreements according to the platform page.
– (0)

Link

GDPR: Unclear Overall assessment: Unclear to conditionally GDPR-suitable. According to the official Privacy Policy, the Kimi OpenPlatform is provided by MOONSHOT AI PTE. LTD. in Singapore; for users from the EEA, Switzerland, and the UK, the policy contains supplementary data protection information and legal bases.

Positive is that data subject rights such as access, deletion, rectification, restriction, data portability, objection, and the right to lodge a complaint are described.

Negative is that the policy covers User Content—i.e., prompts, audio, images, videos, files, and generated content—and explicitly states that data may be used to improve, develop, train, and refine the underlying technology, such as machine learning models.

Server location: according to the policy, the servers are located in Singapore; personal data may be processed and stored there. No verified information is publicly available regarding a DPA/AVV, EU hosting, SCCs, or a complete list of subprocessors for EU customers. For GDPR-critical use, Kimi is therefore only advisable after additional contractual review and, if possible, without personal or confidential data. Sources: Kimi OpenPlatform Privacy Policy and Terms of Service.

Kimi OpenPlatform Privacy Policy

Link

Leading AI models on a secure platform operated in Germany.

DeutschlandGPT provides models such as GPT, Claude, Gemini, Llama, and Mistral through a single interface. Users can chat, analyze documents and images, perform real-time web searches, configure their own assistants or specialized applications, and integrate external business systems. The platform is designed for individual users, teams, companies, and public or data-sensitive organizations.GermanyGPT

Leading AI models on a secure platform operated in Germany.

7.7/10 KIFOX Score – Good
Free Try it for free: A permanently free plan with a limited number of daily messages, custom prompts, and limited file and image analysis. Subscription Pro All leading AI models, projects, integrations, specialized applications, and higher usage limits.

5x Pro Pro features with significantly higher usage limits for more intensive individual use.

Business Pro features plus centralized user management, white labeling, prioritized support, and configurable retention periods; for SMBs and teams.

Enterprise Business features plus custom domain, SAML SSO, SCIM provisioning, Customer Success Manager, dedicated onboarding, invoice billing, and AI training. Other Enterprise Trial Access Time-limited trial access for larger organizations, available by arrangement.

Germany GPT API Usage-based access to various AI models; billing depends on the model and token consumption.

Fair Use Model Paid platform plans have higher limits but are subject to rules against automated bulk usage and resale.
– (0)

Link

GDPR: Yes Overall assessment: Good to very good GDPR compliance. DeutschlandGPT is operated by DeutschlandGPT GmbH, based in Germering, and provides a publicly available data processing agreement in accordance with Article 28 of the GDPR.

Positive aspects include storage on German infrastructure, an external data protection officer, configurable retention periods, two-factor authentication, encryption, client isolation, backups, and documented technical and organizational measures. The DPA explicitly governs the processing of account data, conversation histories, user inputs, files, and contextual content.

DeutschlandGPT states that it has concluded agreements on zero data retention with the connected AI providers. According to these agreements, data is not to be stored by the respective AI provider after model processing and is not to be used for training the models. T-Systems, Hetzner, IONOS, Microsoft Ireland, AWS EMEA, Google Cloud EMEA, Mistral AI, and OpenAI Ireland are listed, among others, as data processors or infrastructure partners.

Server location: According to the provider, persistent data storage takes place in Germany on the Open Telekom Cloud or in T-Systems data centers in Magdeburg and Biere. DeutschlandGPT cites BSI-C5-certified infrastructure and ISO 27001-related security standards for this purpose.

External integrations, optional third-party services, and processing by different model providers are considered negative or subject to review. Even with Zero Data Retention, data transfers may occur for the actual inference process. Users must therefore continue to assess model selection, legal basis, and special categories of personal data themselves.

Conclusion: For German companies, DeutschlandGPT is among the more privacy-friendly multi-model platforms. For corporate use, terms of service, retention periods, role-based access rights, activated models, and integrations should be documented, and sensitive data should only be processed in accordance with internal AI policies.

Privacy Notice

Link