Which LLM provider should I choose?

CompanyWizard ships no model of its own — you bring the access. In time, Managed AI takes that off your hands: there, access, key and models come with the licence, billed against a hard monthly budget. During the beta phase Managed AI cannot be booked yet, so you add a key of your own (bring your own key). Before you do (how), answer the question that comes first: which provider fits your data-protection situation? This page compares the provider types — as a properties matrix, not a yes/no verdict.

Conformity is your whole setup, not the provider alone

“GDPR-compliant” is not a property of a provider, but of your entire deployment: a signed data processing agreement (DPA), the chosen data location, sub-processors, a zero-retention arrangement, and your own technical and organizational measures. The table states the checkable facts per provider — the legal conclusion is yours (or your data protection officer’s) for your use case. Keep two levels apart while you do: EU data residency means processing happens in the EU — the provider behind it may be established outside; EU sovereign means only EU-native providers are involved, so no entity in the chain is subject to US access law. See GDPR & data processing, Data sovereignty and Managed AI: what it covers.

How to read the table

Column	Meaning
Data location	Where prompts and responses are processed. EU / US / configurable (region selectable) / China
DPA	Data processing agreement available: yes / on request / no
Zero-retention	No storage of inputs/outputs after the response: yes / opt-in / check
Third-country/SCC	Data transfer outside the EU, standard contractual clauses + transfer impact assessment required: yes / no / depends on region / check
Type	Direct (provider hosts models) · Aggregator (router across many models) · Hyperscaler (cloud platform)
CW setup	Standard = enter key (how) · otherwise a dedicated article

As of July 2026. Provider offerings change — verify critical cells at the source before deciding.

0 · Recommended: Cortecs (EU aggregator)

Cortecs.ai (Cortecs GmbH, Vienna) is the aggregator our Managed AI package runs on as well — and the only entry in this matrix that offers both routing modes: processing in the EU, or EU-native providers only. If you want to keep the choice between data residency and true sovereignty open, this is the shortest path.

Provider	Data location	DPA	Zero-retention	Third-country/SCC	Type	CW setup
Cortecs.ai (EU data residency)	EU	yes¹	yes	depends on model²	Aggregator	Standard³
Cortecs.ai (EU sovereign)	EU (EU-native providers only)	yes¹	yes	no	Aggregator	Standard³

¹ With Managed AI through evanto, with Cortecs as a sub-processor; with a key of your own you sign the DPA with the provider directly — on request. ² EU data residency means processing happens in the EU. The model provider behind it may be established outside the EU — the sovereign variant rules exactly that out, at the price of a smaller choice of models. ³ Enter the key as for any OpenAI-compatible provider, endpoint https://api.cortecs.ai/v1/. → Where do I get an LLM API key?

As of September 2026.

Your own key today, Managed AI later

Managed AI brings the same access without a key of your own — model upkeep, quality levels and a hard monthly budget included. During the beta phase it cannot be booked yet. Until then you create a key of your own at Cortecs; switching later costs you no more than repointing the provider, not the choice of provider.

1 · EU providers

Providers with an EU data location as the starting point. Even so: sign a DPA and check the retention setting. For Mistral, DPA, zero-retention and the third-country question deliberately read check: that Mistral counts among the EU-native providers is evidenced for the chain of our Managed AI package — for a contract of your own with Mistral we have no source. Verify all three at the source before you add the key.

Provider	Data location	DPA	Zero-retention	Third-country/SCC	Type	CW setup
Cortecs.ai	EU	yes	yes	depends on mode	Aggregator	see group 0
IONOS (AI Model Hub)	EU (DE)	yes	yes¹	no	Direct	Set up
Mistral AI	EU (FR)	check	check	check	Direct	Standard
EU-Router	EU²	on request	yes	no	Aggregator	Set up
Scaleway (Generative APIs)	EU (FR)	yes	yes (default)	no	Direct	Set up
Requesty.ai	EU (Frankfurt)	on request	opt-in	no	Aggregator	Set up

¹ IONOS operates statelessly — prompts/responses are discarded after the session, not used for training, and no data leaves Germany. ² EU-Router is an OpenAI-compatible EU gateway: the EU data location depends on the routing rule you choose — you create it at the provider first and store it as a custom field in CompanyWizard. Details in the setup article.

2 · US frontier providers

The strongest models, US processing by default. EU use is possible but not the default — depending on the provider it requires an EU region, an enterprise contract, and SCCs.

Provider	Data location	DPA	Zero-retention	Third-country/SCC	Type	CW setup
OpenAI	US (EU region possible³)	yes	opt-in³	yes³	Direct	Standard
Anthropic (Claude)	US⁴	yes	opt-in⁴	yes	Direct	Standard
xAI (Grok)	US	on request	check	yes	Direct	Standard

³ OpenAI offers European Projects with in-region processing and zero-retention; without that option, US processing + SCCs are required. ⁴ Anthropic processes in the US by default; zero data retention only with an enterprise/team key. Native EU residency only via Bedrock/Vertex EU regions (see group 3).

3 · Hyperscaler cloud

Frontier models through your cloud platform — with a selectable EU region and the DPA of your cloud contract. Setup usually needs region, project/deployment ID; see AI models / providers.

Provider	Data location	DPA	Zero-retention	Third-country/SCC	Type	CW setup
AWS Bedrock	configurable (EU)	yes	yes	depends on region	Hyperscaler	Providers
Google Vertex AI	configurable (EU)	yes	yes	depends on region	Hyperscaler	Providers
Azure OpenAI	configurable (EU)	yes	yes	depends on region	Hyperscaler	Providers

Models are not used for training; the data location follows the selected region. The US parent company may, depending on interpretation, establish a third-country transfer — clarify with your data protection officer.

4 · Others

Provider	Data location	DPA	Zero-retention	Third-country/SCC	Type	CW setup
OpenRouter	configurable / US	check	opt-in	yes	Aggregator	Standard
z.ai (Zhipu / GLM)	China	no	check	yes ⚠️	Direct	Standard

For aggregators (OpenRouter) the routing rule determines the actual data location — the matrix classification applies only to the default configuration.

z.ai / Zhipu: third-country transfer to China

The z.ai cloud API processes in China and is subject to Chinese law (including the National Intelligence Law). For personal data from the EU this is a third-country transfer with high requirements. The GLM models are open source (MIT) and can alternatively run locally via Ollama or at an EU provider — which removes the transfer.

What comes next

Once you have decided, move on to the mechanics: Where do I get an LLM API key? describes how a key is created and stored encrypted in CompanyWizard. Provider management itself lives under AI models / providers.

Related

• Where do I get an LLM API key? · AI models / providers
• GDPR & data processing · Data sovereignty · Bring your own model