Security & Compliance Comparison
SOC 2, HIPAA, GDPR, ISO 27001, data retention, on-prem options — for every major AI platform.
| AI Platform | 🔒SOC 2 Type II | 🏥HIPAA | 🇪🇺GDPR | 📋ISO 27001 | 🖥️On-Prem / VPC | 🧠Trains on Data | 📍EU Data Residency | 🗑️Zero Retention | 📝BAA Available | Data Retention |
|---|---|---|---|---|---|---|---|---|---|---|
ChatGPT Enterprise OpenAI · Enterprise | Yes | Enterprise | Yes | Yes | No | No | Enterprise | Yes | Enterprise | Zero retention by default (Enterprise) |
Claude Enterprise Anthropic · Enterprise | Yes | Enterprise | Yes | Yes | No | No | Partial | Yes | Enterprise | 30 days (API); configurable for Enterprise |
Gemini for Workspace Google · Enterprise | Yes | Yes | Yes | Yes | No | No | Yes | Yes | Yes | Configurable (0–180 days); no retention option available |
Microsoft Copilot Microsoft · M365 E3/E5 | Yes | Yes | Yes | Yes | Yes | No | Yes | Yes | Yes | Follows Microsoft 365 retention policies |
GitHub Copilot GitHub · Business/Enterprise | Yes | Partial | Yes | Yes | No | No (Biz+) | Partial | Partial | No | Code suggestions not retained after session (Business/Enterprise) |
Azure OpenAI Microsoft · Azure | Yes | Yes | Yes | Yes | Yes | No | Yes | Yes | Yes | Zero retention by default; no Microsoft/OpenAI access to prompts |
Amazon Bedrock AWS · Cloud | Yes | Yes | Yes | Yes | Yes | No | Yes | Yes | Yes | No retention by default; inputs/outputs not used for training |
Cohere Cohere · Enterprise | Yes | Yes | Yes | Yes | Yes | No | Yes | Enterprise | Yes | 30 days default; configurable with Enterprise |
Mistral AI Mistral · Cloud/Self | Planned | No | Yes | Planned | Yes | Opt-out | Yes | Partial | No | 30 days (La Plateforme); self-managed if self-hosted |
Meta Llama Meta · Self-hosted | Self-managed | Self-managed | Self-managed | Self-managed | Yes | No | Yes | Yes | Self-managed | Fully self-managed |
What each standard means for your business
SOC 2 Type II
Independent audit of security, availability, and confidentiality controls.
HIPAA
Required for healthcare data. Look for a BAA (Business Associate Agreement) too.
GDPR
EU data protection regulation. Essential for European customers or employees.
ISO 27001
International standard for information security management systems.
On-Prem / VPC
Deploy within your own infrastructure. Critical for regulated industries.
EU Data Residency
Data stays within EU borders. Required for some GDPR use cases.
Zero Retention
Option to have zero data stored after the API call completes.
BAA Available
Business Associate Agreement — required to use the tool with PHI under HIPAA.
Enterprise buying tip
For regulated industries (healthcare, finance, government), prioritise Azure OpenAI or Amazon Bedrock — both run inside your own cloud tenant with zero data egress to the model vendor. For EU-first deployments, Mistral AI is the only major model vendor incorporated in the EU. For maximum control, self-hosted Meta Llama gives you a fully air-gapped option.
Data accurate as of Q1 2026. Compliance offerings change frequently — always verify with vendor documentation before procurement.