Provider Trust Registry

Trust tiers and compliance certifications for all AI providers

The Provider Trust Registry contains compliance information for all AI providers available through Case.dev. Use this data to configure governance policies that meet your regulatory requirements.

Verification Required: We aggregate compliance information from provider documentation, but you should verify certifications directly with providers for your specific regulatory requirements.

Provider Compliance Matrix

Most Trusted Providers

Full enterprise compliance with SOC 2 Type II, HIPAA, BAA, and Zero Data Retention.

Provider	SOC 2	HIPAA	BAA	ZDR	HQ	Data Residency
Anthropic	Yes	Yes	Yes	Yes	US	US, EU
OpenAI	Yes	Yes	Yes	Yes	US	US, EU
Azure OpenAI	Yes	Yes	Yes	Yes	US	US, EU, UK
Google (Vertex AI)	Yes	Yes	Yes	Yes	US	US, EU
AWS Bedrock	Yes	Yes	Yes	Yes	US	US, EU

Trusted Providers

Good compliance posture, may lack some certifications.

Provider	SOC 2	HIPAA	BAA	ZDR	HQ	Data Residency
Groq	Yes	Yes	Yes	Yes	US	US
DeepInfra	Yes	Yes	-	Yes	US	US, EU
Fireworks	Yes	Yes	-	Yes	US	US
Together AI	Yes	Yes	-	Yes	US	US
Mistral	Yes	-	-	Yes	FR	EU
Cohere	Yes	Yes	Yes	Yes	CA	US, EU

Untrustworthy Providers

China-based or subject to national security laws. Always blocked by default.

Provider	SOC 2	HIPAA	BAA	ZDR	HQ	Risk
DeepSeek	-	-	-	-	CN	National security laws
Baidu	-	-	-	-	CN	National security laws
Alibaba Cloud	-	-	-	-	CN	National security laws
ByteDance	-	-	-	-	CN	National security laws

China-Based Providers: Under Chinese national security laws, companies can be compelled to provide data to the government. We block these providers by default for all organizations.

Query Provider Registry

Get provider compliance data programmatically.

cURL

curl https://api.case.dev/admin/provider-registry \
  -H "Authorization: Bearer sk_case_xxx"

Response

{
  "providers": [
    {
      "slug": "anthropic",
      "name": "Anthropic",
      "trustTier": "most_trusted",
      "headquarters": "US",
      "compliance": {
        "soc2": true,
        "hipaa": true,
        "baa": true,
        "zdr": true,
        "iso27001": true,
        "gdpr": true
      },
      "dataResidency": ["US", "EU"],
      "models": ["claude-sonnet-4-20250514", "claude-3-5-haiku-20241022"]
    },
    {
      "slug": "openai",
      "name": "OpenAI",
      "trustTier": "most_trusted",
      "headquarters": "US",
      "compliance": {
        "soc2": true,
        "hipaa": true,
        "baa": true,
        "zdr": true,
        "iso27001": true,
        "gdpr": true
      },
      "dataResidency": ["US", "EU"],
      "models": ["gpt-4o", "gpt-4o-mini", "o1", "o3-mini"]
    }
  ]
}

Filter by Compliance

cURL

curl "https://api.case.dev/admin/provider-registry?compliance=soc2,hipaa" \
  -H "Authorization: Bearer sk_case_xxx"

Filter by Trust Tier

cURL

curl "https://api.case.dev/admin/provider-registry?trustTier=most_trusted" \
  -H "Authorization: Bearer sk_case_xxx"

Provider Registry Schema

TypeScript Types

interface Provider {
  slug: string;                    // Unique identifier (e.g., "anthropic")
  name: string;                    // Display name (e.g., "Anthropic")
  trustTier: TrustTier;            // Trust tier classification
  headquarters: string;            // Country code (e.g., "US", "CN")
  compliance: ComplianceFlags;     // Compliance certifications
  dataResidency: string[];         // Available data regions
  models: string[];                // Available models
}

type TrustTier = 
  | "most_trusted"    // Full enterprise compliance
  | "trusted"         // Good compliance, some gaps
  | "sketchy"         // Limited compliance info
  | "untrustworthy";  // China-based or high-risk

interface ComplianceFlags {
  soc2: boolean;      // SOC 2 Type II certified
  hipaa: boolean;     // HIPAA compliant
  baa: boolean;       // BAA available
  zdr: boolean;       // Zero Data Retention
  iso27001: boolean;  // ISO 27001 certified
  gdpr: boolean;      // GDPR compliant
  dpdp: boolean;      // India DPDP compliant
}

Certification Details

SOC 2 Type II

SOC 2 Type II certification demonstrates that a provider has implemented controls for:

• Security: Protection against unauthorized access
• Availability: System availability for operation and use
• Processing Integrity: System processing is complete, valid, accurate, timely
• Confidentiality: Information designated as confidential is protected
• Privacy: Personal information is collected, used, retained, and disclosed appropriately

HIPAA Compliance

HIPAA compliance indicates the provider can handle Protected Health Information (PHI):

• Administrative safeguards
• Physical safeguards
• Technical safeguards
• Policies and procedures

HIPAA + BAA Required: HIPAA compliance alone is not sufficient. You must also execute a Business Associate Agreement (BAA) with the provider to use them for PHI.

Business Associate Agreement (BAA)

A BAA is a contract required by HIPAA when a covered entity shares PHI with a business associate:

• Defines permitted uses of PHI
• Requires appropriate safeguards
• Specifies breach notification requirements
• Allows termination if terms are violated

Zero Data Retention (ZDR)

Zero Data Retention means the provider:

• Does not store request/response data beyond processing
• Does not use your data for model training
• May still log metadata for abuse prevention
• Typically requires enterprise agreement

Data Residency

Some regulations require data to remain in specific geographic regions:

Region	Common Requirements
US	HIPAA, SOX, FERPA
EU	GDPR, EU-US Data Privacy Framework
UK	UK GDPR, UK-US Data Bridge
APAC	PDPA (Singapore), DPDP (India), PIPL (China)

Data Residency Policies: Use providerAllowlist in your governance policy to restrict to providers with specific data residency options.

Next Steps

Browse All Models

Explore 195+ models with pricing and capabilities in our visual catalog.

Policy Configuration

Create policies using provider compliance data.

Audit Logging

Track which providers are used in your requests.