OpenRouter: DPA, subprocessors and data location

Where to find the OpenRouter DPA and subprocessor list, how much notice you get of new subprocessors, where data is stored and how it leaves the EU. Each fact has a source link and the date we checked it. Typical use: llm routing api. The table is the short version; the sections below add detail.

OpenRouter at a glance

Notes on OpenRouter

OpenRouter's DPA (last updated August 26, 2026) takes effect when you accept the Terms of Service. It lists OpenRouter as processor, and section 2.2 makes you responsible for reviewing the data handling terms of each AI model provider and configuring your account accordingly.

Notice of new subprocessors is 30 days, but only if you subscribe by email and excluding AI Model Providers (section 5.2). You have 30 days to object, and if OpenRouter has no workaround within 60 days you can terminate that part of the Service with a refund (section 5.3).

Hosting is on Google Cloud in US regions (Schedule 2). EU-only processing of API payloads exists only as an elected addendum (Exhibit A) and does not cover account, billing, authentication or log data.

OpenRouter DPA: where to find it and how it is accepted

Read the DPA on openrouter.ai. The DPA forms part of the Terms of Service and becomes effective when you accept or otherwise agree to the Agreement that incorporates it. The page shows Last Updated: August 26, 2026. A separate Exhibit A to the Enterprise Access Agreement carries a DPA for enterprise customers..

Not stated in the source we checked (2026-10-17).

The DPA forms part of the Terms of Service or other electronic agreement and lists no plans. Its EU-only addendum applies only if you elect it in an Order Form or other written agreement.

OpenRouter subprocessors: the list and how change notices reach you

OpenRouter's subprocessor list.

How changes are announced: Email, for customers who subscribe (section 5.2).

Notice before a new subprocessor starts: 30 days.

Section 5.2: only if you subscribe by email, and excluding processing by AI Model Providers, OpenRouter gives thirty (30) days notification before authorizing a new subprocessor. You can also configure your account to exclude processing by certain AI Model Providers.

You can object within 30 days. OpenRouter uses reasonable efforts to offer a change in the Service or a configuration change. If it cannot within 60 days, you may terminate the affected part of the Service and get a refund of prepaid fees for the remaining term without penalty (section 5.3).

Section 5.3: object in writing within thirty (30) days of receiving the notice.

Where OpenRouter stores data

• United States (Google Cloud Platform regions)
• EU or EEA for API payloads, only if the EU-only addendum is elected

Schedule 2 says hosting is on Google Cloud Platform in US regions, with data at rest region-restricted. Exhibit A (the EU-Only Processing Addendum) applies only where you elected EU-only processing of API payloads through the EU API in an Order Form or other written agreement. It does not cover account data, billing records, authentication data, security logs or abuse monitoring metadata, which may be processed outside the EU or EEA. Requests routed to AI Model Providers are subject to those providers' terms.

How OpenRouter moves data outside the EU and UK

• SCCs (Module 2)
• UK Addendum
• Swiss SCC modifications

Section 13.2 enters Module 2 (controller to processor) of the SCCs, with Irish law and Dublin courts. Sections 13.3 and 13.4 add the UK Addendum and Swiss modifications. The DPA text does not mention the Data Privacy Framework.

Is OpenRouter a processor or a controller?

Processor: it handles your customers' data on your instructions.

Section 2.1: the customer is the Controller and OpenRouter is the Processor.

Is OpenRouter GDPR compliant?

We don't give a compliance verdict, and no vendor can be 'GDPR compliant' on its own; compliance depends on how you use it. Here is what OpenRouter's own documents say:

• A DPA is published: The DPA forms part of the Terms of Service and becomes effective when you accept or otherwise agree to the Agreement that incorporates it. The page shows Last Updated: August 26, 2026. A separate Exhibit A to the Enterprise Access Agreement carries a DPA for enterprise customers.
• A subprocessor list is published.
• Notice of new subprocessors: 30 days. Section 5.2: only if you subscribe by email, and excluding processing by AI Model Providers, OpenRouter gives thirty (30) days notification before authorizing a new subprocessor. You can also configure your account to exclude processing by certain AI Model Providers.
• Transfer mechanisms named: SCCs (Module 2), UK Addendum, Swiss SCC modifications.
• Data locations named: United States (Google Cloud Platform regions), EU or EEA for API payloads, only if the EU-only addendum is elected.

What stays with you: accepting or signing the DPA where it needs that, choosing and setting the region, your own records of processing, and any consent or notices your own users need.

Add OpenRouter to your own subprocessor list

This row uses the facts above. Change the purpose to match how you use OpenRouter, then paste it into your list, or open it in the generator to add your other vendors.

| Vendor | Purpose | Data location | Transfer mechanism | Vendor DPA | Vendor subprocessor list |
| --- | --- | --- | --- | --- | --- |
| OpenRouter | LLM routing API | United States (Google Cloud Platform regions); EU or EEA for API payloads, only if the EU-only addendum is elected | SCCs (Module 2); UK Addendum; Swiss SCC modifications | [DPA](https://openrouter.ai/data-processing-agreement) | [Subprocessors](https://trust.openrouter.ai/) |

Add to my list

If you add or replace OpenRouter: what to tell your customers

Under Art. 28(2) GDPR, a processor that engages another processor needs its customer's authorisation. Where that authorisation is general, the processor must tell the customer about intended additions or replacements and give it a chance to object. The GDPR sets no fixed number of days. Customer DPAs usually set one, so check the number you agreed to.

OpenRouter states 30 days of notice before it adds a subprocessor. Section 5.2: only if you subscribe by email, and excluding processing by AI Model Providers, OpenRouter gives thirty (30) days notification before authorizing a new subprocessor. You can also configure your account to exclude processing by certain AI Model Providers. If your own customers were promised a longer notice, you have a gap to plan for.

Use the subprocessor list template for the list itself. Tell customers before the change takes effect: what changes, the new vendor's purpose and location, the date, and how to object.

What changed

2026-10-17

First check: facts recorded from OpenRouter's own DPA (last updated August 26, 2026). The Trust Center subprocessor list could not be read as text.

Related vendors

• AI and LLM APIs
• OpenAI LLM API
• Anthropic LLM API (Claude)
• ElevenLabs Voice and speech AI
• Gemini API LLM API (Google)
• Groq LLM inference API (GroqCloud)
• Mistral AI LLM API
• All vendors

Sources and method

• https://openrouter.ai/data-processing-agreement checked 2026-10-17
• https://trust.openrouter.ai/ checked 2026-10-17

Facts come from OpenRouter's own public pages, read by hand, and can change. Read the source before relying on it. The facts and templates here are not legal advice. How we check: methodology, which also says where to report an error. Official site: openrouter.ai.