Opper AI Trust Center

Continuously monitored

Last updated Sep 30, 2026

Security and compliance at Opper

One EU sub-processor for every AI model, certified against ISO/IEC 27001:2022.

Data Processing Agreement Privacy Policy

127

controls

32

resources

57

subprocessors

Compliance

2

Independently audited and continuously evidenced against the standards our customers rely on.

Compliant

GDPR

General Data Protection Regulation (GDPR)

Compliant

ISO 27001

ISO/IEC 27001:2022

Valid through: Sep 15, 2029
Certificate: 160926-1

Controls

127

The safeguards we operate across our organization, technology, people, and facilities.

Inventory Labels

Asset Management

Organization assets are labeled and have designated owners.

Reviewed Sep 2, 2026ISO 27001

Continuity Testing

Business Continuity

Organization performs business contingency and disaster recovery tests on a periodic basis and ensures the following: • tests are executed with relevant contingency teams • test results are documented • corrective actions are taken for exceptions noted • plans are updated based on results

Reviewed May 25, 2026ISO 27001

Business Impact Analysis

Business Continuity

Organization identifies the business impact of relevant threats to assets, infrastructure, and resources that support critical business functions. Recovery objectives are established for critical business functions.

Reviewed Sep 4, 2026ISO 27001

Capacity Forecasting

Business Continuity

Budgets for infrastructure capacity are established based on analysis of historical business activity and growth projections; purchases are made against the established budget and plans are updated on a quarterly basis.

Reviewed Sep 4, 2026ISO 27001

Backup Configuration

Backup Management

Organization configures redundant systems or performs periodic backups of data to resume system operations in the event of a system failure.

Reviewed Sep 15, 2026ISO 27001

Resilience Testing

Backup Management

Organization performs annual backup restoration or data replication tests to confirm the reliability and integrity of system backups or recovery operations.

Reviewed May 25, 2026ISO 27001

Baseline Configuration Standard

Configuration Management

Organization ensures security hardening and baseline configuration standards have been established according to industry standards and are reviewed and updated periodically.

Reviewed Sep 4, 2026ISO 27001

Configuration Checks

Configuration Management

Organization uses mechanisms to detect deviations from baseline configurations on production environments.

Reviewed Jul 7, 2026ISO 27001

Resources

32

Policies, documentation, and reports that govern how we protect customer data.

Secure Development Policy

Version 2026.1 · Reviewed Aug 26, 2026 · yearly

Information Security Objectives 2026

Version 2026.1 · Reviewed Aug 25, 2026 · yearly

Endpoint Lifecycle Procedure

Version 2026.1 · Reviewed Aug 27, 2026 · yearly

Security Assurance & Performance Standard

Version 2026.1 · Reviewed Aug 27, 2026 · yearly

Data Breach Response & Continuity Plan

Version 2026.1 · Reviewed Aug 27, 2026 · yearly

Technical Security Controls & Roles

Version 2026.1 · Reviewed Aug 27, 2026 · yearly

Third-Party Management & Data Transfer Policy

Version 2026.1 · Reviewed Aug 27, 2026 · yearly

DPIA & Risk Management Methodology

Version 2026.1 · Reviewed Aug 27, 2026 · yearly

Subprocessors

11

Third-party providers that process customer data on our behalf, and where that data is stored and processed.

Search

Evroc

Infrastructure

EU sovereign cloud; Opper's second production environment (se-sto, Stockholm) running the self-managed Kubernetes stack, PostgreSQL, storage and backups. Customer data and generation content are hosted here. Also serves models to customers who select Evroc-hosted models.

Sweden

Exa

Software as a Service

Optional web search engine for the Opper web search tool, used only when a customer selects it. Receives search queries from customer requests. Exa may use search queries to train and improve its own models.

United States

Jina AI

Software as a Service

Web search and page fetching for the Opper web search tool (default engine). Receives search queries and URLs from customer requests; EU endpoints.

Germany

Auth0 (Okta)

Software as a Service

Customer authentication for the Opper platform (EU tenant): sign-up, login and session management.

Germany, Ireland

Datadog

Software as a Service

Monitoring of both production environments: infrastructure metrics, traces, access and application logs, request identifiers, IP addresses, and user and organization identifiers. Routine logging is designed to exclude prompts, responses and uploaded files.

Germany

Mixpanel

Software as a Service

Product analytics for the Opper platform: user and organization identifiers, name, email address, organization information, product usage events, and approximate location derived from IP address. Session recordings, heatmaps and automatic event capture are disabled.

EU/EEAAny member state

Sentry

Software as a Service

Error reporting for the Opper platform web app: exception details, stack traces, breadcrumbs, request routes, and user and organization identifiers. Request bodies and cookies are removed from error events; session replay and performance tracing are disabled.

Germany

Resend

Software as a Service

Transactional and product e-mail delivery: e-mail address, name, organization information, message content, and delivery and engagement metadata; also manages contact lists and subscriptions.

Ireland, United States

Data location is where the provider stores and processes customer data.

Model providers

46

AI model providers that process customer data only when a model from that provider is selected.

Search

GreenPT

AI model provider

Model provider. Receives the content of customer requests sent to its models, only when a customer selects them. Runs in the EEA. Does not store request content; whether a content-safety filter runs is being confirmed. Not used to train models.

EU/EEAAny member state

Greenference

AI model provider

Model provider. Receives the content of customer requests sent to its models, only when a customer selects them. Runs in the EEA. Does not store request content. Not used to train models.

EU/EEAAny member state

greenference.com

TensorX

AI model provider

Model provider. Receives the content of customer requests sent to its models, only when a customer selects them. Does not store request content. Not used to train models.

EU/EEAAny member state

Moonshot AI

AI model provider

Model provider. Receives the content of customer requests sent to its models, only when a customer selects them. Runs globally without a pinned region. May retain request content for abuse monitoring; retention period not published. Request content may be used to train Moonshot AI's models.

Global

Meta

AI model provider

Model provider. Receives the content of customer requests sent to its models, only when a customer selects them. Runs globally without a pinned region. May retain request content for abuse monitoring; retention period not published. One contributed model may use request content for training.

Global

SCX

AI model provider

Model provider. Receives the content of customer requests sent to its models, only when a customer selects them. Does not store request content. Not used to train models.

Australia, United States, Global

Regolo

AI model provider

Model provider. Receives the content of customer requests sent to its models, only when a customer selects them. Does not store request content. Not used to train models.

Italy

Nextbit

AI model provider

Model provider. Receives the content of customer requests sent to its models, only when a customer selects them. May retain request content for up to 90 days. Not used to train models.

Spain, Global

Data location is where the provider stores and processes customer data.

Questions about our security?

We're glad to help your security and procurement teams move quickly.

Contact us Data Processing Agreement Privacy Policy