Every field is source-linked and dated.See the rubric behind the grades.

How we grade
Sovereign AI Registry
ExploreBlogGov accessCertsCountries

Footer

Sovereign AI Registry

The compliance registry for AI vendors. Data residency, training defaults, retention, subprocessors and EU AI Act posture — one row per vendor, product and deployment, every claim linked to its source.

Registry

  • Explore vendors
  • Deployment models
  • Categories
  • Countries

Compliance

  • Gov access exposure
  • EU AI Act roles
  • Certifications

Resources

  • FAQ
  • Methodology
Built with ShipMore·Build yours →

© 2026 Sovereign AI Registry. All rights reserved.

  1. Explore
  2. GLM API (international)
GA

GLM API (international)

Sovereignty grade D (36/100). No EU residency; no training on your data. Z.ai, Singapore.

Category
foundation-model
Categories
Foundation model
EU AI Act role
General-purpose AI (GPAI)
Deployments
Hosted API
Government access exposure
PRC National Intelligence Law
Countries
Singapore

Details

Deployment
hosted
Hq Country
Singapore
Hq City
Singapore
Ownership
private
Founded
2019
Trust Center Url
docs.z.ai/legal-agreement/privacy-policy
Training Default
never
Residency Options
Singapore
Gov Access Exposure
prc-nil
Eu Ai Act Role
gpai
DPA available
yes
Zero Retention Available
Yes
Retention Default
"The Company do not store any of the content the Customer or its End Users provide or generate while using our Services. This includes any texts, or other data you input. This information is processed in real-time to provide the Customer and End Users with the API Service and is not saved on our servers." — DPA for API Services, clause 4(b).
Retention Exceptions
The consumer-facing side of the same policy is materially different: it gives a legitimate-interests basis for processing personal data "including in developing, improving, or promoting our Services, such as when we train and improve our models". The zero-retention commitment is specific to the API DPA.
Subprocessor Count
0
Transfer Mechanism
none-stated
Eu Procurement Ready
fail
Eu Procurement Reason
The API DPA is genuinely good — controller/processor roles set out properly, Singapore processing, and an explicit statement that no input content is stored. What it does not do is name a single subprocessor, name any Article 46 transfer instrument (only "legally recognized transfer mechanisms"), or mention China anywhere. The controller of record is JINGSHENG HENGXING TECHNOLOGY PTE. LTD in Singapore; the models are GLM, and the Z.ai Group is the Zhipu AI group, which puts the PRC National Intelligence Law over the corporate parent. Singapore has no EU adequacy decision.
Training Evidence Url
docs.z.ai/legal-agreement/privacy-policy
Training Claim Basis
stated
Training Confidence
medium
Residency Evidence Url
docs.z.ai/legal-agreement/privacy-policy
Residency Claim Basis
stated
Residency Confidence
high
Retention Evidence Url
docs.z.ai/legal-agreement/privacy-policy
Retention Claim Basis
stated
Retention Confidence
high
Subprocessors Evidence Url
docs.z.ai/legal-agreement/privacy-policy
Subprocessors Claim Basis
inferred
Subprocessors Confidence
low
Residency Class
non-eu-only
Portability / Exit Path
serves-open-models
Subprocessor Jurisdiction
undisclosed
Underlying model providers
Z.ai / Zhipu AI (GLM)
At a glance
Governance Grade
D
Governance Score
36
EC SOV-2 Legal & Jurisdictional (0-4)
0
EC SOV-3 Data & AI (0-4)
1
Website

Similar

Read AI · Sep 2026

RARead AI meeting assistant

Sovereignty grade F (24/100). No EU residency. Read AI, United States.

meeting-ai
Governance Grade
F
Fathom · Aug 2026

FAFathom AI notetaker

Sovereignty grade D (35/100). No EU residency. Fathom, United States.

meeting-ai
Governance Grade
D
Granola · Sep 2026

GAGranola AI notepad

Sovereignty grade D (30/100). No EU residency. Granola, United States.

meeting-ai
Governance Grade
D

More Categories

  • Coding assistant15
  • meeting-ai13
  • Sovereign host13
  • Inference host13
  • SaaS-embedded11
  • Foundation model11
  • Cloud platform7

More EU AI Act role

  • Deployer59
  • General-purpose AI (GPAI)10
  • provider9
  • GPAI with systemic risk5

More Deployments

  • Hosted API68
  • Self-hosted weights6
  • On-premise6
  • Private VPC2

More Government access exposure

  • US CLOUD Act44
  • No non-EU government access27
  • Mixed jurisdiction9
  • PRC National Intelligence Law2

More Countries

  • United States45
  • Germany9
  • France7
  • Switzerland5
  • Singapore3
  • Israel2
  • United Kingdom2
  • China2
  • Netherlands2