Loading the catalogue…
OpenAI
L0 · Third-country operatoropenaiUnited States
OpenAI's own API for the GPT, o-series, Codex, audio and image models, run by OpenAI OpCo on Microsoft Azure in the United States. API data is not used for training and is deleted after 30 days.
Operated by OpenAI · first-partyopenai.com ↗
Compliance posture · Stav's assessment
Jurisdiction
US · United States
Data residency
GLOBAL
CLOUD Act / FISA 702
Exposed
Stav sovereignty level
Stav's assessment
Five dimensions
Serving residency
Poor
Legal exposure
Poor
Serving retention
Weak
Security posture
Weak
Contractual posture
Adequate
Bands only. The scores and Stav's notes per dimension are read in the workspace.
Customers only
The full assessment
Stav's narrative, every risk item with its source, the safeguards that offset them and the privacy-policy issues found: the part of the page a procurement review runs on.
Stav's narrative · 6 risk items · 7 safeguards · 1 privacy-policy issue · DPA, sub-processor list, terms, privacy policy — sign in to read them.
Traffic through Stav is covered by Stav's customer DPA, which lists Stav's sub-processors.
Stav's serving-side assessment, compiled from the provider's published documentation and Stav's operational review. Last reviewed 17 Oct 2026. An assessment, not a guarantee or regulatory determination. Confirm against the provider's own documentation before contracting.
Sovereignty ladder · how the level was reached
L0Third-country operatorIndicativeregistry 4.1
This level applies to traffic routed through Stav.
OpenAI is at L0. Its served endpoints run on US infrastructure, and OpenAI is subject to the CLOUD Act and FISA 702, so no L1 criterion is met. L1 would require EU/EEA compute for the served endpoints.
3 criteria from L1: Customer data in the Union, Infrastructure in the Union, No coerced vulnerability silence.
Stav's own assessment against criterion registry 4.1. Indicative, not an official recognition, which only a national authority can confer. Criteria follow the proposed Cloud and AI Development Act and are expected to change. “Union” reads as EU/EEA at every rung. CADA itself still says “in the Union”: until the Act is incorporated into the EEA Agreement, a Norwegian, Icelandic or Liechtenstein route does not evidence formal Union assurance for an EU public-sector buyer. UK and Swiss providers are capped at L1.
Verified 17 Oct 2026About the ladder →Certifications & legal documents · the provider's own facts
SOC 2 Type II
Security, Availability, Confidentiality, and Privacy Trust Services Criteria for the OpenAI API Platform, ChatGPT Enterprise, and ChatGPT Edu · Claimed by the provider
ISO/IEC 27001:2022
Schellman certificate 1404936-1, holder OpenAI, OpCo, LLC; OpenAI API, ChatGPT Enterprise and ChatGPT Edu; valid to 7 August 2028. · substantial assurance · Current · verified 17 Oct 2026
ISO/IEC 27701:2019
Same Schellman certificate 1404936-1 extends the ISMS to a PIMS for the API, ChatGPT Enterprise and Edu. · Current · verified 17 Oct 2026
ISO/IEC 42001:2023
AI management system covering OpenAI's consumer and business AI products and models · Current
ISO/IEC 27017:2015
Cloud security controls for OpenAI API, ChatGPT Enterprise, and ChatGPT Edu services · Claimed by the provider
ISO/IEC 27018:2019
Protection of personally identifiable information (PII) in public clouds for OpenAI API, ChatGPT Enterprise, and ChatGPT Edu services · Claimed by the provider
PCI DSS
Components of ChatGPT that support delegated payment processing for merchant transactions · Current
FedRAMP 20x Moderate (Class C)
ChatGPT Enterprise and the OpenAI API for U.S. federal agency use · Current
“Claimed by the provider” means the provider states the certification. Stav has not seen the certificate or report.
Terms of servicepublished
Privacy policypublished
Data processing agreement (DPA)published
Sub-processor listpublished
Links to every document and certificate — 4 legal documents, 8 certification sources
Compiled by Stav from the provider's published documentation. Last verified 17 Oct 2026. Reflects what the provider states, not a Stav guarantee or regulatory determination. Confirm against the provider's own pages before contracting.
Endpoints served · 27
| Model | Input / M | Output / M | TTFT | Tok/s |
|---|---|---|---|---|
| gpt-6.1-sol | €1.79 | €8.96 | 0.95 s | 144 |
| gpt-6-luna | €0.09 | €0.45 | 0.64 s | 158 |
| gpt-6-sol | €1.79 | €8.96 | 0.76 s | 274 |
| gpt-6-astra | €8.96 | €44.82 | 1.10 s | 132 |
| gpt-5.6-luna | €0.18 | €1.08 | 1.01 s | 392 |
| gpt-5.6-sol | €3.59 | €17.93 | 1.29 s | 379 |
| gpt-5.6-terra | €1.79 | €10.76 | 0.83 s | 193 |
| gpt-5.5 | €4.48 | €26.89 | 0.93 s | 248 |
| gpt-5.5-pro | €26.89 | €161.36 | — | — |
| gpt-5.4-mini | €0.67 | €4.03 | 0.39 s | 157 |
| gpt-5.4-nano-2026-03-17 | €0.18 | €1.12 | — | — |
| gpt-5.4 | €2.24 | €13.45 | 0.43 s | 153 |
| gpt-5.4-pro | €26.89 | €161.36 | — | — |
| gpt-4o-mini-tts-2025-12-15 | €0.54 | €10.76 | — | — |
| gpt-4o-transcribe-diarize | €2.24 | €8.96 | — | — |
| gpt-5-mini | €0.22 | €1.79 | 1.33 s | 318 |
| gpt-5-nano-2025-08-07 | €0.04 | €0.36 | 2.28 s | 471 |
| o3-pro-2025-06-10 | €17.93 | €71.71 | — | — |
| gpt-4o-mini-transcribe-2025-03-20 | €1.12 | €4.48 | — | — |
| gpt-4o-mini-tts | €0.54 | €10.76 | — | — |
| gpt-4o-mini-tts-2025-03-20 | €0.54 | €10.76 | — | — |
| gpt-4o-transcribe | €2.24 | €8.96 | — | — |
| gpt-4-turbo | €8.96 | €26.89 | 1.29 s | 28 |
| gpt-4 | €26.89 | €53.79 | 0.94 s | 38 |
| gpt-3.5-turbo | €0.45 | €1.34 | 1.27 s | 113 |
| gpt-4o-mini-transcribe-2025-12-15 | €1.12 | €4.48 | — | — |
| o3-pro | €17.93 | €71.71 | — | — |