openrouter-compliance-review

# OpenRouter Compliance Review ## Overview OpenRouter is a proxy that routes requests to upstream providers (OpenAI, Anthropic, Google, etc.). Compliance depends on both OpenRouter's data handling and the selected provider's policies. Key considerations: data transit through OpenRouter infrastructure, provider-specific data retention, model selection for regulated data, and audit trail requirements. ## Compliance Checklist ```python COMPLIANCE_CHECKLIST = { "data_handling": [ "Verify OpenRouter does NOT train on your data (confirmed in their privacy policy)", "Confirm provider-level data policies (OpenAI, Anthropic, Google each differ)", "Document data flow: your app -> OpenRouter -> provider -> OpenRouter -> your app", "Identify if prompts contain PII, PHI, or regulated data", "Implement PII redaction before sending to API", ], "access_control": [ "Use per-service API keys (not shared keys)", "Set credit limits per key to isolate blast radius", "Rotate keys on a 90-day schedule", "Store keys in secrets manager (not .env files in repos)", "Enable management keys for programmatic key provisioning", ], "audit_trail": [ "Log every API call with generation_id, model, user_id, cost", "Hash prompts (SHA-256) instead of logging raw content", "Retain audit logs per regulation (90d operational, 7yr financial)", "Ship logs to append-only storage (S3, i...