There is a race in the AI space today over who can dominate the market, and I think the race can be divided between closed and open-source models.
In the US, we have AI labs with closed-source models such as OpenAI and Anthropic. China is about open-source with AI labs such as DeepSeek, Alibaba, Moonshot AI, and Zhipu AI.
In regulated fields, though, you cannot use any model without a strict agreement that your data won’t be used for training the model, and that it won’t be retained at inference.
In SAFi, under compliance settings, you will find the option to turn AI providers on and off based on whether they meet these strict enterprise requirements:
- BAA (Business Associate Agreement): The legal contract required for HIPAA compliance, ensuring the provider safely handles protected healthcare data.
- EU (European Union Data Residency): Ensures the data is processed strictly within European borders to comply with GDPR.
- ZDR (Zero Data Retention): A contractual guarantee that the API provider will process your data in memory and drop your prompts and outputs immediately after generating a response, without logging them to disk.
As of now, the primary AI providers that meet these requirements out of the box are:
- Anthropic
- OpenAI
- Google Gemini
- Mistral
As you can see, the only major open-source model builder on that standard list is Mistral.
Of course, hosting the AI models yourself is the ultimate privacy and data leak prevention.
All hosted open-source models claim that they don’t retain any data, but I don’t think they can hand you an agreement with that claim, and even if they do, I don’t know if it can be enforced in other countries such as China.
There are companies in the US such as Groq and Cerebras that host open-source models. While these companies do offer protections like Zero Data Retention and enterprise compliance, you won’t find self-serve click-through agreements on their standard developer tiers. To get a binding data privacy agreement or a BAA signed on paper, you need to connect directly with their enterprise sales teams.
