Provider claims

Each provider can state how it handles your data and which audits it passed. The exchange shows each statement as a badge. You can require a claim, so that only providers that hold it can serve your calls.

Require a claim

Add exchange.privacy.requirements to the exchange block of a request:

{
  "model": "gpt-oss-120b",
  "messages": [{ "role": "user", "content": "Summarize this contract." }],
  "exchange": {
    "privacy": {
      "requirements": {
        "require": ["zero_retention", "soc2_type2"],
        "checked_only": true
      }
    }
  }
}

require lists claims. The provider must hold every one.
checked_only is false by default. When it is true, a declared claim does not pass.

What happens:

The exchange leaves out each offer from a provider that fails the rule. The receipt names the reason provider_requirements for each excluded offer.
A provider with no claim data fails any requirement.
If no provider meets the rule, the call fails with an error. It does not run on a weaker provider.

A guardrail can set the same rule for a whole workspace. Open Guardrails and choose the step Data privacy. A rule on a key or a preset and a rule on a request combine. The union of the claims applies, and checked_only applies if either sets it. See Purchasing rules and Guardrails.

The Require chips on the order book, the models page and the provider directory only filter the list on your screen. They do not change what the exchange buys.

What a badge shows

The shape of a badge shows how much you can rely on the claim.

Badge	Name	Meaning
Solid tint and a filled seal	Checked	A reviewer read the document and recorded an end date. The badge shows until that date.
Dashed outline	Declared	The provider states it. The exchange has not seen evidence.
Clock	In review	The provider sent a document. A reviewer has not decided. A declared claim stays declared until the decision.
Line through the text, and a warning	Lapsed	The exchange checked it, and the end date passed. A lapsed claim does not pass any requirement.
Hatched question mark	Unknown	The provider states nothing. Treat the data as retained and used for training.

The badge shows the standing on the day you look at it. A checked claim with no end date counts as lapsed.

What a provider can claim

Claim	Meaning
Zero retention	The provider stores no prompt and no output after the response.
Kept N days	The provider stores prompts and outputs for N days.
No training	The provider does not train a model on your prompts.
May train	The provider can train a model on your prompts.
Certifications	SOC 2 Type I and II, ISO 27001 and 42001, HIPAA BAA, GDPR DPA, HITRUST, FedRAMP Moderate, PCI DSS and CSA STAR.

Retention and training are two separate facts. A provider can keep data for 7 days and never train on it. A prompt that stays in memory for caching is not retention. The list of claims is closed. SOC 2 Type I and Type II are different claims.

In API calls, the claim names are zero_retention, retention_days, no_training, may_train, soc2_type1, soc2_type2, iso27001, iso42001, hipaa_baa, gdpr_dpa, hitrust, fedramp_moderate, pci_dss and csa_star.

Claims and the retention policy

exchange.privacy.retention: "none" and the zero_retention claim are two different tools.

exchange.privacy.retention: "none" uses the promise in the offer. The provider makes that promise, and the exchange does not check it.
zero_retention with checked_only: true needs a claim that a reviewer checked and that has not lapsed.

See Data handling.

Where the badges appear

Table row: three fixed slots show retention as a short word, training as an icon, and the strongest certification with a count of the others. Hover over a slot or move focus to it to see the full wording.
Provider page: the section "Data and compliance" lists every claim with its status and dates.
Quote page: the data policy lists the claims of the provider.
Receipt: the claims are those that held when the exchange awarded the job. A claim that had lapsed is left out. A later change does not rewrite them.

For providers

You can declare claims when you register. You can also add or change them later on the Registration page of your provider.

Choose how long you keep prompts, whether you train on them, and the certifications you hold. Save the claims.
Each claim shows as declared. Buyers who require checked claims skip you until the exchange checks it.
Choose Add a document for a claim. Send one PDF of 10 MiB or less. For a certification, send the report.
The claim shows a clock while the document waits for a decision.
The exchange approves or rejects the document. The decision appears on your page. A rejection includes a note that tells you what to fix.

A reviewer confirms these points before an approval:

The name on the document matches your registered company.
The document covers the environment that serves jobs.
The document is dated within the last 12 months. A certification report must cover a period that ended within the last 12 months.
A report has no qualified opinion, and the auditor is on the list that the exchange accepts.

An approval sets an end date. The claim shows as checked until that date. The exchange publishes the result, never the file.

At expiry:

The exchange sends you a warning 14 days before the end date.
On the end date, the check lapses. The claim does not pass any buyer requirement.
To restore the check, send a new document before the end date. The old check stays valid until a reviewer decides.

Remove a claim to stop stating it.