# Zhipu AI / Z.ai – GLM

## Kurzbeschreibung
**Inspiring AGI to Benefit Humanity - free AI chatbot & agent powered by GLM**


Zhipu AI is a Chinese large language model provider that operates internationally under the name Z.ai. At its core is the GLM model family for text, reasoning, agents, coding, vision, OCR, image, video, and audio capabilities. The platform offers API access, coding plans, web search, Translation Agent, and Slide/Poster Agent.

## Claim
LLM "Inspiring AGI to Benefit Humanity - free AI chatbot & agent powered by GLM"

## Geeignet für
- API Integration
- Audio / Voice
- Automation / Workflows
- Images
- Data Extraction / Document Analysis
- Presentations
- Programming / Software Development
- Research
- Texts / Content
- Translations
- Video

## Kernfunktionen
- Function calls
- AI agents
- LLM API
- Multimodal AI
- open-source model
- Programming
- Reasoning model
- Language model
- Text generation

## Preismodell
- **free:** **GLM-4.5-Flash / free quotas**

Z.AI describes GLM-4.5-Flash as a free model variant for reasoning, coding, and agents; in addition, free trial quotas may be available depending on the platform status.
- **subscription:** **GLM Coding Plan**

Personally assigned coding subscription for officially supported coding tools; not intended for general API use, resale, or use by third parties.
- **other:** **API Usage / Usage-Based Billing** API access to GLM models, SDKs, OpenAI-compatible usage, streaming, function calling, structured output, context caching, and tool usage; billing is usage-based depending on the model and platform rules.


**Enterprise / Individual Agreements** Separate written agreements are possible; no confirmed information is available regarding standardized EU enterprise plans or EU hosting.

## DSGVO und Datenschutz
**Gesamteinschätzung:** No

**On-Prem / local hosting: indirect / not available**


On-premise or local hosting of the Z.ai/GLM solution is not stated on the website. There are references to 'open-source' or 'open-weight' models, but there is no documented self-hosting or local deployment guide for the service evaluated here.


**Private Cloud / data center: unclear**


A dedicated private cloud, single-tenant, or specifically segregated data center option is not stated on the website.


**EU SaaS / managed: indirect / not available**


The website does not mention an EU-/EEA-based managed SaaS operation. Instead, it states that the services are generally provided from Singapore and that customer data is generally processed in Singapore.


**Hybrid: unclear**


A hybrid operating model with partly local/internal and partly external processing is not stated on the website.


**DPA / DPA: partial**


A DPA for API services is documented on the website and contains typical processor obligations. However, no separate DPA execution process, no downloadable contract document for customers, and no further EU-specific contractual documentation are stated on the website.


**No training: partial**


For API services, it is stated that End User Content is used only to provide the API services, to comply with law, to enforce policies, and to prevent abuse, and not to develop or improve the services except with explicit consent. For other website/product use outside the API context, an equally strong exclusion is not clearly documented on the website.


**Open-source / transparency path: partial**


The website repeatedly refers to 'open-source' or 'open-weight' in connection with model performance and mentions open or open-source tools such as OpenCode or Eigent as an integration path. However, a complete sovereign open-source/self-hosting path for the evaluated service itself is not stated on the website.


**Data processing**


For API services, the website describes processing under a processor model. According to the DPA, customer data is generally processed in Singapore. API input and output content is reportedly not stored, but processed in real time; other customer data may be stored temporarily for service provision or to fulfill legal obligations. For international data transfers, the website refers only generally to appropriate safeguards and legally recognized transfer mechanisms. Subprocessors and specific data center locations are not stated on the website.


**Conclusion**


From an EU-/EEA perspective, the documentation is not sufficient for GDPR-compliant use. Although privacy documents and a DPA for API services exist, the documented standard operation is in Singapore, without declared EU data residency, without EU data centers, without a proven European hosting path, and without clearly documented subprocessors or certifications. Therefore, no reliable positive GDPR assessment is documented for a European tool directory; the best path evidenced on the website is not sufficient.


**Sources**


- [https://docs.z.ai/legal-agreement/privacy-policy](https://docs.z.ai/legal-agreement/privacy-policy)
- [https://docs.z.ai/legal-agreement/terms-of-use](https://docs.z.ai/legal-agreement/terms-of-use)
- [https://docs.z.ai/guides/overview/overview](https://docs.z.ai/guides/overview/overview)
- [https://docs.z.ai/guides/llm/glm-5](https://docs.z.ai/guides/llm/glm-5)
- [https://docs.z.ai/devpack/tool/eigent](https://docs.z.ai/devpack/tool/eigent)

Although the website documents a privacy policy as well as a DPA for API services embedded in the privacy policy, it does not demonstrate fully GDPR-compliant use for the European region. The main factor arguing against this is that, according to the provider’s own statement, it generally provides the services from Singapore and, as a rule, processes customer data in Singapore. An EU/EEA data residency, EU data centers, an EU SaaS offering, on-premise/self-hosting of the actual model, or a European hosting path are not stated on the website.


**Positive**


Positively documented are a privacy policy, a DPA for API services, the classification of the provider as a processor for customer data in the API context, commitments to process data only on instructions, and the statement that End User Content for API services is not used to develop or improve the services except with explicit consent. In addition, it is stated that content in the API service is not stored but processed in real time.


**Negative**


The main negative point is that, according to the website, the services are generally provided from Singapore and customer data is, as a rule, processed in Singapore. For international transfers, only general references are made to 'appropriate safeguards' and 'legally recognized transfer mechanisms,' without naming specific EU mechanisms, SCC documents, EU data centers, or EU data residency. Subprocessors, specific server locations, certifications such as ISO 27001 or SOC 2, and an AVA/DPA conclusion process as a separate customer artifact are not stated on the website. A self-hosting or on-premise route for the platform is also not stated.


**Server location**


The website states that the provider generally provides the services from Singapore, that group companies and commissioned service providers are typically based in Singapore, and that customer data is, as a rule, processed in Singapore. An EU/EEA data center or EU data residency is not stated on the website.

## Hosting und Daten
- **On-Prem / lokales Hosting:** unknown
- **Private Cloud / Rechenzentrum:** unknown
- **EU SaaS / Managed:** unknown
- **Hybrid:** unknown
- **AVV / DPA:** teilweise / indirekt
- **Kein Training auf Kundendaten:** teilweise / indirekt
- **Open-Source / Transparenz-Pfad:** teilweise / indirekt

## Standort
**Land:** China

**Taxonomie:** China

JINGSHENG HENGXING TECHNOLOGY PTE. LTD., 10 Anson Road, #26-03, International Plaza, Singapore 075903

## Vorteile
- Very broad model portfolio.
- Well suited for coding, agents, tool use, web search, and multimodal workflows.
- Open model weights for GLM-4.5 and GLM-5 according to official sources.
- International API/developer documentation path available.

## Nachteile
- GDPR situation for EU companies is not fully transparent.
- No publicly and clearly documented EU-only operation.
- Chinese provider with an international Singapore contract path; data transfers and subprocessors must be contractually reviewed.
- Many models/versions change quickly, so version control is important.

## Quellen
- Offizielle Website: https://docs.z.ai/guides/overview/pricing?utm_source=chatgpt.com

## Letzter Datenstand
2026-05-06

## Originalseite
https://kifox.ai/en/ki-tools/zhipu-ai-z-ai-glm-en/