Openlayer

GDPR overview

Openlayer states GDPR compliance explicitly rather than leaving it to inference: the security page carries a GDPR badge alongside SOC 2 Type II and HIPAA, and the about page repeats the claim. The privacy policy and the DPA are both dated 28 July 2026. Section 11 of the privacy policy sets out EEA rights — access, rectification, erasure, restriction, objection, portability, withdrawal of consent and the right to complain to a supervisory authority. Two Article 27 representatives are named, one for the EU in Dublin and one for the UK in Brighton, and a Data Protection Lead is identified by name and email. The published DPA incorporates the 2021/914 Standard Contractual Clauses under Irish law, adds the UK and Swiss addenda, and gives customers fifteen days' notice and a right to object before any subprocessor change.

Who owns the data?

Under section 4.2 of the terms, the customer keeps all right, title and interest in Customer Data, a category defined broadly enough to cover datasets, model inputs and outputs, prompts and completions, traces, spans, inference logs, evaluation results and their metadata. Openlayer receives only a non-exclusive worldwide licence to host, copy, process, transmit and display that data, and solely to provide, maintain, secure and support the service or to act on the customer's documented instructions. Openlayer is the processor for Customer Data and the controller only for account, billing and telemetry data. It keeps ownership of its own software and of any feedback submitted to it.

Reuse rights

The customer stays free to use and reuse its own data without asking Openlayer for permission: the licence granted runs the other way, and it is narrow. Openlayer commits, in three separate documents — the privacy policy, section 4.4 of the terms and section 2 of the DPA — never to use Customer Data to train, fine-tune or otherwise develop its own or any third party's models, never to sell it and never to share it between clients. Service improvement relies instead on configuration, performance and usage data, and on aggregated or de-identified data. Managed AI features do send portions of Customer Data to OpenAI, engaged as a subprocessor under terms the site describes as intended to prohibit training and limit retention. Model providers a customer connects with its own credentials remain that customer's own vendors, not Openlayer's subprocessors.

Data retention & training

Hosting summary

The cloud platform runs on Amazon Web Services in the United States, principally the us-west-2 region, with the marketing website served by Vercel. Account, workspace, billing and configuration data sit in managed PostgreSQL; inference logs, traces, spans and evaluation results in ClickHouse and MongoDB; files and datasets in Amazon S3; and Redis handles queuing and caching. The security page advertises multi-region hosting and states that data can be stored in the EU or the US, though it does not say what activating the EU option requires. Data is encrypted with AES-256 at rest and TLS 1.2 or above in transit, secrets are encrypted before storage, and storage is redundant with automated backups. Platform availability is quoted at 99.9%, rising to a 99.99% SLA on the Enterprise plan. Self-hosted and on-premise deployments are available, including air-gapped installation inside the customer's own VPC with no external network connection. Transfers out of the EEA, the UK and Switzerland rely on the Standard Contractual Clauses. Named subprocessors include AWS, Vercel, OpenAI, Sentry, PostHog, HubSpot, WorkOS, Resend and Stripe, with the authoritative list kept on an external trust centre.