Procurement and security review
One page for the security, privacy and procurement review of the ISMS Copilot API: DPA, sub-processors, zero data retention, EU aliases, limits and pricing, with links to the binding documents.
This page answers the questions a security, privacy or procurement reviewer asks before a team integrates the ISMS Copilot API. It summarises; the binding text is on the Trust Center, and the Trust Center wins where the two differ.
At a glance
| Topic | Answer | Source |
|---|---|---|
| Supplier | Better ISMS EURL (ISMS Copilot), under French law | API Terms |
| Your role, our role | You are the controller of personal data in your requests; we act as your processor. For our own usage and billing records we are an independent controller. | API DPA |
| DPA | Click-through: accepted through your API account, effective on acceptance. Questions: privacy@ismscopilot.com | API DPA |
| Sub-processors | Infrastructure (Fly.io, Supabase, Sentry, Axiom), AI inference by mode (Mistral AI for the -eu aliases; OpenRouter, Together AI, Fireworks AI, Inceptron for the global aliases), Stripe for billing | API sub-processors |
| Request content | Prompts and answers are not stored as records after the response is returned. Usage metadata only (tokens, cost, model, status, timestamps, key) | Zero Data Retention |
| Training | Your content is not used to train any model | API sub-processors |
| Breach notification | Without undue delay and within 24 hours of becoming aware of a personal data breach | API DPA |
| Audit | On written request, about once every 12 months with 30 days' notice, at your cost, with exceptions after a breach or when a supervisory authority requires it | API DPA |
Where requests are processed
| Aliases | AI inference | Transfers |
|---|---|---|
isms-fast-eu, isms-thinking-eu | Mistral AI (France), on Mistral's EU endpoint. No AI-model processing outside the EEA. | None for inference. |
isms-fast, isms-thinking, isms-mini | Routed by OpenRouter to zero-retention hosts, some in the US | To the US, under the EU Standard Contractual Clauses |
On both paths, the API backend runs on Fly.io's EU deployment and its metadata database is in the EU; these providers are US companies, covered by the Standard Contractual Clauses (details per provider on the sub-processor page). If a reviewer needs AI processing kept in the EU, the answer is: use the -eu aliases only, and enforce that in your code (for example, one key used only with -eu aliases).
Each response carries x-isms-processing-region (eu or global). It reports the path of the alias you called; the sub-processor list is the authoritative description.
Data handling detail
- In flight only. Request content exists in memory while the request is served. It is not written to our database. Upstream, the global path uses zero-retention endpoints; on the
-eualiases, Mistral's own retention terms apply, as listed on the sub-processor page. - What we keep. A usage and billing ledger (token counts, cost, model, status, timestamps, key and account identifiers) for metering, fraud prevention and French accounting rules. No prompt or answer text. Which framework modules were injected is not stored either.
- Logs and errors. Operational logs (30 days) and error monitoring are configured not to hold request bodies; credentials are scrubbed.
- Verify it yourself. Make a call, then open platform.ismscopilot.com/usage: you see tokens, cost and status, never the text.
Access and keys
- Keys are created by a signed-in user in the console, shown once, prefix
sk-isms-. Up to 20 active keys per user. - Each key can have a spend cap per hour, day, week or month, and can be revoked at any time.
- Keys and credits belong to a user, not to an organisation. There are no sub-accounts or roles inside the API today.
- The API never sees your end users' identities unless you put them in the prompt. Keep personal data out of prompts where the question does not need it.
Limits and service behaviour
| Item | Value |
|---|---|
| Wire | OpenAI-compatible chat completions, text-only subset: no tool calling, no JSON mode, no images, n of 1. Streaming supported. |
| Rate limit | 120 requests per minute per key; can be raised per key on request |
| Context window | 128,000 tokens per request, input and output together |
| Timeouts | 5 minutes per request, 90 seconds without upstream data |
| Errors | OpenAI error shape with stable codes: Errors and error codes |
| Model changes | Aliases are the stable contract; upstream models can change. The prompt we add is published word for word and versioned: The system prompt, in full |
| Knowledge changes | Public changelog of module changes: GET https://api.ismscopilot.com/v1/frameworks/changelog |
Pricing and payment
- Prepaid credits, card payment through Stripe, minimum top-up USD 20. No subscription and no commitment.
- Unit rates per million tokens are published in the console at platform.ismscopilot.com/pricing, which is the billing source of truth.
- Volume pricing on request for platforms with steady monthly volume: write to us at chat.ismscopilot.com/support.
What this API is not
- Not legal advice or an audit opinion: answers are compliance guidance your experts review.
- Not the full text of standards: framework modules are curated reference notes in original words, injected at inference and named on every response. See Framework knowledge.
- Not the ISMS Copilot chat product: workspaces, memories and uploaded documents are chat features with their own terms.
Checked against the Trust Center on 2026-10-28 (API DPA effective 2026-07-26, API sub-processor list effective 2026-10-20). If a line here and the Trust Center disagree, the Trust Center is binding; tell us so we can fix this page.