Enterprise Trust

AI Foundation Services gives you a single OpenAI-compatible API across two clearly separated categories of models — those operated by Telekom in Germany, within the EU, and those forwarded to third-party providers under their own terms. This page summarizes the trust and compliance posture; the Service Description (PDF) is the binding source.

Zero data retention, no training on customer data

For every model hosted by Telekom (Category 1), customer prompts and responses are not permanently stored and are never used to train or fine-tune any model. Security questionnaires usually call this zero data retention (ZDR); the binding wording is the Service Description’s. Note that on language models, prefix caching keeps processed requests for a limited time so repeat requests are answered faster; it is on by default and can be switched off. See Prefix caching. Zero data retention does not apply to Category 2 models, which follow the third-party provider’s terms.

Data handling summary

Aspect	Category 1 (EU-operated)	Category 2 (Third-party)
Processing location	Germany (EU)	Determined by third-party provider; may be worldwide
Storage	Zero data retention: not permanently stored (short-lived prefix cache on language models, on by default, can be switched off)	Per third-party provider’s terms (Telekom’s zero data retention does not apply)
Visibility	Not viewable by Telekom or third parties	Per third-party provider’s terms
Training use	Not used for model training	Per third-party provider’s terms
Encryption in transit	TLS-secured (HTTPS)	TLS-secured (HTTPS)
Authentication	API keys via Self-Service Portal	API keys via Self-Service Portal

Infrastructure and certifications

Category 1 models run on T Cloud Public, Telekom’s cloud in Germany. These are infrastructure certifications for that T Cloud Public infrastructure, not a separate AIFS certificate:

• ISO/IEC 27001:2022. Deutsche Telekom AG group certificate, DEKRA no. 172572.00DE. Its sites include the T-Systems data centers in Biere and Magdeburg. Certificate (PDF)
• ISO/IEC 27017 and ISO/IEC 27018. DEKRA attestation no. DS-1221076/1. Attestation (PDF)
• ISO/IEC 27701:2019. Deutsche Telekom AG group certificate no. DE182572.00. Certificate (PDF)
• BSI C5 Type 2. Audit report for T Cloud Public, available on request.
• SOC 2 Type II. Report for the T Cloud Public (Open Telekom Cloud) system in the German and Dutch data centers, available on request. SOC 3 summary
• TISAX Level 3. T Cloud Public, regions Germany and Netherlands (ENX ID P0R4YM). Details

For the full list and current documents, see T Cloud Public certifications and attestations.

Note

These documents cover Telekom-operated infrastructure only. They do not cover Category 2 models, which run on the third-party provider’s own infrastructure under its own certifications and terms. The documents above are those published for T Cloud Public. For questions about scope, contact the AIFS team.

Two model categories — pick the right one for your data

The Service Description splits the catalog into two categories with materially different data-sovereignty profiles. Selecting a model is selecting its data-handling regime.

Category 1 — processing in Germany, within the EU

Operated by Telekom on T Cloud Public and the Industrial AI Cloud. Examples:

• Google Gemma 4 31B
• Mistral Small 4
• Alibaba Qwen 3.6 35B
• Alibaba Qwen 3.8 27B
• NVIDIA Nemotron 3 Super
• Zhipu AI GLM 5.3
• Zhipu AI GLM 5.3 Flash
• OpenAI GPT-OSS-120B
• OpenAI Whisper Large v3 / v3 Turbo (STT)
• Jina embeddings v2, BAAI BGE m3, Qwen3 Embedding 8B (embeddings)
• Qwen3-Reranker-4B (Reranker)
• LightOnOCR-3-4B, PaddleOCR-VL-1.6 (OCR)

For these models:

• Data processing happens in Germany, within the EU
• Customer prompts and returned results are not permanently stored and not viewable by Telekom or third parties

Category 2 — third-party providers, sub-processors worldwide

Forwarded by Telekom directly to the third-party provider, who runs the model on its own infrastructure. Examples:

• OpenAI GPT-5.6 Sol and GPT-5.6 Terra — on Microsoft Azure (Sweden)
• OpenAI GPT-6 Luna — on Microsoft Azure (Sweden)
• OpenAI GPT-6.1 Sol — on Microsoft Azure (Sweden)
• OpenAI GPT-6 Astra — on Microsoft Azure (Sweden)
• OpenAI GPT Image 2 — on Microsoft Azure (Sweden)
• OpenAI Ada Text Embedding — on Microsoft Azure (France)
• Anthropic Claude Sonnet 5.5 and Claude Opus 5.5 — on Google Cloud (europe-west1) or Microsoft Azure
• Anthropic Claude Haiku 5.5 and Claude Fable 5.1 — on Google Cloud (worldwide) or Microsoft Azure
• Google Gemini 3.5 Flash, Gemini 3.8 Flash and Gemini 3 Pro Image — on Google Cloud (worldwide)
• Google Gemini 4 Argon — on Google Cloud (worldwide)

For these models:

• The third-party provider may operate sub-processors worldwide, so customer data may be processed worldwide
• By selecting a Category 2 model, the customer accepts the third-party provider’s terms, license, and data-protection policies
• Outages of these third-party providers are excused from Telekom’s availability calculation

Caution

Certain data categories (for example social or health data under German law) may not legally be processed outside the EU/EEA. Reviewing the legal basis for using a specific model is the customer’s sole responsibility.

EU AI Act alignment

• Telekom delivers the service in line with its applicable obligations under Regulation (EU) 2024/1689 (the AI Act).
• The customer is contractually required to use the service in compliance with the AI Act.
• The service is not designed or permitted for high-risk AI systems as defined by the AI Act, nor for any prohibited use case.
• The service is not a medical device under MDR and may not be used for diagnosis, prevention, monitoring, prediction, prognosis, treatment, or alleviation of disease.

GDPR & data processing

• Category 1 models run on GDPR-compliant EU hosting on T Cloud Public (EU Regulation 2016/679 (GDPR)). For Category 2 models, the third-party provider’s data-protection terms apply.
• A Data Processing Agreement (DPA) based on Telekom’s template is available on request — required if the customer processes personal data through the service.
• Telekom acts as a data processor; the customer remains the data controller.
• The customer is responsible for confirming that the data they submit is lawful to process, including processing-location restrictions.

Termination & data deletion

The service can be terminated with one month’s notice to month-end. Upon termination, all access is deactivated and customer data is deleted. See Service levels: Termination.

Compliance & procurement

For enterprise procurement teams evaluating AI Foundation Services:

• Service Description (PDF) — The Service Description is the binding contractual document covering scope, SLAs, terms, and pricing.
• Compliance questionnaires — Contact us to receive completed security questionnaires (CAIQ, VSA, or custom formats).
• Data processing agreement — Request a DPA tailored to your requirements.
• Security documentation — Available under NDA.
• Contact — Contact us.