SOC 2 does not prove what are claiming. It audits OpenRouter controls, does not guarantee every downstream model provider retention or training behavior.

Actually, OpenRouter own terms...explicitly say they do not warrant providers data handling, retention, training, or security practices...and their Enterprise terms say... model providers are not OpenRouter subcontractors and that customers must assess those providers themselves... ;-)