Enterprise Access Agreement

Last Updated: June 22, 2026

This Enterprise Access Agreement ("Agreement") is made and entered into as of the effective date set forth in the applicable Order Form (as defined below) (the "Effective Date") by and between OpenRouter Inc., a Delaware corporation with offices at 169 Madison Ave #2404, New York NY 10016, United States ("OpenRouter"), and the entity set forth in the Order Form (defined below) ("you", "Customer").

By mutually executing one or more Order Forms which references this Agreement, you agree to be bound by the terms of this Agreement. If you are entering into this Agreement on behalf of an entity, then you represent and warrant that you are authorized to bind such entity to the terms of this Agreement. Any capitalized terms used but not defined herein will have the meanings set forth in the DPA (defined below).

Recitals

WHEREAS, OpenRouter provides the Service (defined below) to enterprise customers as a product development and productivity tool for team members across customer organizations and for usage in customers' products and services, in exchange for Credits-based usage fees (defined below); and

WHEREAS, Customer desires to license from OpenRouter the Service under the terms and conditions of this Agreement;

NOW, THEREFORE, in consideration of the mutual premises and of the performance of the mutual covenants herein, the parties agree as follows:

1. Definitions

1.1 "Admin User" means a Customer employee or contractor designated with administrative privileges to manage Customer's account at the organization level, including provisioning Authorized Users, setting spending controls, and other configuration settings described in the Documentation.

1.2 "AI Models" means the third-party generative artificial intelligence models accessed via API through the Service and listed on the OpenRouter website at https://openrouter.ai/models.

1.3 "AI Model Provider" means the provider of the applicable AI Model.

1.4 "AI Model Terms" means the respective terms and conditions for each AI Model, and disclosed by the respective AI Model Provider.

1.5 "API" means the application programming interface for accessing AI Models through the Service, whether third-party or provided by OpenRouter.

1.6 "API Key" means a unique code used to authenticate and authorize access to an API.

1.7 "Authorized Users" means Customer's employees, consultants, and contractors authorized to access and use the Service.

1.8 "BYOK" or "Bring-Your-Own-Key" means Customer's own API Keys for certain AI Models, that Customer may use with the Service.

1.9 "Credits" means the usage-based credits that are linked to Authorized Users' accounts.

1.10 "Customer Data" means all Customer-provided data to OpenRouter, including Credits used, AI Models utilized, Tokens used, Inputs, Outputs, Authorized Users' IP addresses, and API calls made.

1.11 "Customer's End Customers" means Customer's customers accessing the Service pursuant to this Agreement.

1.12 "Data Protection Laws" means the meaning given to it in the DPA.

1.13 "Documentation" means electronic or hardcopy manuals, designs, drawings, specifications, datasheets, slide decks or documents received from OpenRouter in connection with the Service under this Agreement.

1.14 "DPA" means the Data Processing Agreement between OpenRouter and Customer, hereby incorporated by reference and attached as Exhibit A.

1.15 "Feedback" means any suggestions, comments or other feedback provided by Customer to OpenRouter, and relating to the Service.

1.16 "Input" means any input from Authorized Users into the Service, which may include images, data, text, and other types of work.

1.17 "Minimum Spend" means the minimum amount Customer must spend on Credits on a yearly, aggregate basis, as described in the Order Form.

1.18 "Order Form" means the order form mutually executed as of the Effective Date, describing pricing and commercial terms for the Service.

1.19 "Output" means an output from the Service based on Authorized User Input.

1.20 "Performance Data" means data generated and/or collected in connection with Customer's use of the Service, such as logs, session data, support data, usage data, statistics, aggregated data, and derivatives thereof, and excluding Customer Data.

1.21 "Personal Data" means the meaning given to it in the DPA.

1.22 "Service" means the unified AI Model aggregator platform at http://openrouter.ai/, which makes numerous AI Models available to platform users via a standardized interface.

1.23 "Token" means the basic unit of text that AI Models use to process and understand language.

1.24 "User Content" means collectively, Inputs and Outputs.

2. License; Restrictions; Data Processing

2.1 License

Subject to Customer's compliance with the terms of this Agreement and payment of all applicable fees, OpenRouter hereby grants to Customer a non-exclusive, non-transferable, non-sublicensable, license (a) to create an OpenRouter API Key(s) or use OpenRouter's BYOK offering to (i) access and internally use the Service in accordance with the Documentation; and (ii) to access and use the Service for the purpose of making the Service available to Customer's End Customers; and (b) to make a reasonable number of copies of the Documentation solely in connection with using the Service.

2.2 AI Model Terms

2.2.1 Availability. OpenRouter does not guarantee availability of the AI Models and provides Customer access to the AI Models only on an as-available basis. AI Model uptime and performance are described in the applicable AI Model Terms, and Customer is responsible for (a) reviewing the AI Model Terms to understand the availability and data practices of each AI Model Provider, and (b) agreeing to the AI Model Terms prior to using the Service.

2.2.2 Suspension and Termination. Customer understands and acknowledges that it is solely responsible for any violation of applicable AI Model Terms, and that such violation (as detected by OpenRouter or reported by the applicable AI Model Provider to OpenRouter) may result in suspension or termination by OpenRouter and/or the AI Model Provider of Customer's access to the applicable AI Model, with or without notice to Customer. It is Customer's responsibility to contact the applicable AI Model Provider to resolve suspension or termination issues. Each AI Model Provider retains sole control over access to its AI Model. While OpenRouter will use commercially reasonable efforts to provide advance written notice to Customer of any suspension or termination of AI Model access, OpenRouter cannot guarantee it can provide advance notice in all circumstances. OpenRouter disclaims all liability for actions taken by AI Model Providers that affect Customer's access to, or use of, applicable AI Models.

2.2.3 Training. Some AI Model Providers store and/or train on Customer's Inputs and Outputs for improving their own large language models, and in some instances, may allow Customer to opt-out of model training, as described in their respective AI Model Terms. OpenRouter provides further information as to AI Model training on its Admin User dashboard but does not configure any customer accounts to opt-out of data training, and is not liable for any errors or misrepresentations made in any AI Model Terms. Customer understands and acknowledges it is solely responsible for ascertaining data training and intellectual property ownership rights in and to any Inputs and Outputs. To the extent Customer does not want Customer Data used for AI Model training, it is Customer's responsibility to opt-out of AI Models that train on data through the Admin User dashboard, or select "Zero Data Retention". Further information is available in the Documentation.

2.3 Restrictions

Customer agrees not to, and will not allow any third party, to:

2.3.1 use the Service for any illegal purpose, in violation of any local, state, national, or international law or in violation of any applicable AI Model Terms;

2.3.2 create a false identity, misrepresent any person's identity, or create multiple accounts as a single user, for purposes of bypassing or circumventing use limits on the Service or for any other reason;

2.3.3 violate, or encourage others to violate, any right of a third party, including by infringing or misappropriating any third-party intellectual property right;

2.3.4 post, upload, or distribute any User Content that is unlawful or in violation of any applicable AI Model Terms;

2.3.5 remove or otherwise alter any proprietary notices or labels from the Service or any portion thereof;

2.3.6 reverse engineer, decompile, disassemble, or otherwise attempt to discover the underlying structure, ideas, or algorithms of the Service or any software used to provide or make the Service available;

2.3.7 rent, resell or otherwise allow any third-party access to or use of the Service;

2.3.8 use, inspect, analyze, or otherwise exploit the Service outside the scope of the express license granted in Section 2.1; or

2.3.9 use the Service in violation of the Documentation.

2.4 Data Processing

Any Personal Data will be processed in accordance with Data Protection Laws and as described in the DPA.

3. Account Provisioning; Management

3.1 Organizational Account Management

OpenRouter will provide Customer with organization-level user management capabilities, including an administrator portal for user provisioning and management, with Admin User and Authorized User roles and spend-limited API Key provisioning.

3.2 Provisioning and Permissions

The Admin User has the ability to provision accounts for Authorized Users, to set global permissions for Authorized Users to opt into prompt and chat logging, and to restrict or grant access to specific AI Models.

4. Ownership

4.1 Proprietary Rights

As between the parties, OpenRouter or its licensors exclusively owns all right, title, and interest in and to the Service and Documentation, and any software or other intellectual property created, used, provided or made available by OpenRouter under or in connection with the Service, and Customer exclusively owns all right, title and interest in and to the Customer Data (but excluding the Outputs) and Performance Data. Customer's rights in and to the Outputs is described in the applicable AI Models Terms that generate such Outputs. OpenRouter shall acquire no rights in or to the User Content, Customer Data or Performance Data, except for the license rights to OpenRouter set forth in Section 4.2.

4.2 License to OpenRouter

4.2.1 Opt-in License for Prompt and Chat Logging. By default, prompt and chat logging is disabled for Customer's account. However, Customer has the option to opt into prompt logging, chat logging, or both, in the Admin User settings. By opting in, Customer hereby grants OpenRouter a worldwide, perpetual, irrevocable, non-exclusive, royalty-free, fully paid up right and license (with the right to sublicense) to host, store, transfer, display, perform, reproduce, modify for the purpose of formatting for display, adapt, translate, and prepare derivative works of, and distribute Customer's User Content, in whole or in part, in any media formats and through any media channels now known or hereafter developed, for purposes of providing the Services to Customer and for OpenRouter's business purposes, including without limitation (1) to log and store, as applicable, Customer's Inputs and/or chat history, (2) to log, copy, store, and distribute, as applicable, Customer's Inputs and/or chats, and associated tokens for purposes of debugging, and (3) to license or sell Customer's User Content in anonymized form, where the User Content is not associated with Customer or Customer's account.

4.2.2 License to Categorize Inputs. OpenRouter uses a hosted model for categorizing Inputs, which does not store or log any Inputs provided to it. In using the Service, Customer hereby grants to OpenRouter a worldwide, perpetual, irrevocable, non-exclusive, royalty-free, fully paid up right and license (with the right to sublicense) to use, host, reproduce, prepare derivative works of, and categorize Customer's Inputs in anonymized form, solely for tracking and sharing user metrics on the Service, such as for example, on OpenRouter's Rankings Page, on an ongoing basis. Unless explicitly opted in to prompt logging, OpenRouter does not store Customer's Inputs after categorizing them and does not associate the categorized Inputs with any specific user or organizational accounts.

4.2.3 Performance Data. Customer hereby grants OpenRouter a limited license to aggregate, collect, analyze, and store Performance Data (a) to provide, maintain, and improve the Service, and (b) in aggregated, de-identified form for OpenRouter's marketing purposes. For clarity, any Performance Data used for marketing purposes will not identify Customer or contain Customer Confidential Information.

4.2.4 Customer Data. Customer hereby grants OpenRouter a limited license (a) to collect, store, and use Customer Data to provide and maintain the Service, and (b) if chat and/or prompt logging is enabled, to license and use Customer Data in aggregated, de-identified form for OpenRouter's business purposes, including without limitation product improvement, analytics, and with OpenRouter's business partners.

4.2.5 Feedback. Customer has no obligation to disclose to OpenRouter any Feedback. However, if Customer discloses Feedback to OpenRouter, Customer hereby grants to OpenRouter a non-exclusive, worldwide, non-terminable, royalty-free, transferable, sublicensable license to use and otherwise exploit such intellectual property rights in or to any such Feedback in or with any OpenRouter products or technology.

5. Fees, Payment

5.1 Fees and Minimum Spend Requirement

Customer understands and agrees that the Minimum Spend is required to retain an enterprise account with OpenRouter. Customer will be billed in accordance with the terms set forth in the Order Form. Fees are subject to change upon renewal.

5.2 Errors

If an AI Model does not return a valid response to Customer's Input, such as providing an error code or zero output tokens, Customer will not be charged.

5.3 BYOK Fees

Should Customer select BYOK, Customer may access the Service without additional fees subject to the BYOK Limit set forth in the Order Form. For each calendar month exceeding the BYOK Limit, Customer will pay a flat fee as described in the Order Form.

5.4 Payment

Customer shall pay those amounts due and not disputed in good faith within seven (7) days of the date of receipt of the applicable invoice, unless a specific date for payment is set forth in such invoice, in which case payment will be due on the date specified. Except as otherwise specified herein or in any applicable invoice or Order Form, (a) fees are quoted and payable in United States dollars and (b) payment obligations are non-cancelable and non-pro-ratable for partial months, and fees paid are non-refundable.

5.5 Late Payment

OpenRouter may suspend access to the Service immediately upon notice if Customer fails to pay any amounts hereunder at least five (5) days past the applicable due date. If OpenRouter has not received payment within five (5) days after the applicable due date, interest will accrue on past due, undisputed amounts at the rate of one percent (1%) per month, but in no event greater than the highest rate of interest allowed by law, calculated from the date such amount was due until the date that payment is received by OpenRouter. In the event Customer elects monthly invoicing and fails to pay two (2) or more invoices by the applicable due dates, OpenRouter reserves the right to require Customer to pre-purchase Credits to continue using the Service.

5.6 Taxes

All amounts payable hereunder are exclusive of any sales, use and other taxes or duties, however designated. Customer will be solely responsible for payment of all applicable taxes or duties, except for those taxes based on the income of OpenRouter. Customer will not withhold any taxes from any amounts due to OpenRouter.

6. Term, Termination

6.1 Term and Renewal

The term of this Agreement begins on the Effective Date and will remain in effect for the initial term set forth in the Order Form (the "Initial Term"), unless sooner terminated. After the Initial Term, the Agreement will automatically renew for successive one (1) year periods (each, a "Renewal Term") unless Customer provides OpenRouter with written notice of its election to terminate this Agreement at least sixty (60) days prior to the expiration of the Initial Term or the then-current Renewal Term, as applicable. The Initial Term together with all Renewal Terms (as defined in the Order Form), if any, shall be collectively referred to as the "Term".

6.2 Termination

Each party may terminate this Agreement upon written notice in the event (a) the other party commits any material breach of this Agreement and fails to remedy such breach within thirty (30) days after written notice of such breach or (b) subject to applicable law, upon the other party's liquidation, commencement of dissolution proceedings or assignment of substantially all its assets for the benefit of creditors, or if the other party becomes the subject of bankruptcy or similar proceeding that is not dismissed within sixty (60) days. Any violation of Section 2.3 is considered a material breach and subject to immediate termination of the Agreement in OpenRouter's sole discretion.

6.3 Post-Termination Obligations

Following any termination of the Agreement, each party will (a) immediately cease use of any Confidential Information of the other communicated for the purposes of this Agreement, and (b) upon the disclosing party's request, within seven (7) days, return or destroy (and certify destruction of) all copies of any Confidential Information of the other party disclosed under the Agreement, subject to each party's customary backup and archival processes, and (c) Customer shall immediately cease using the Service, except as necessary to export Customer Data. Following termination of the Agreement, Customer may export all Customer Data using the export functionality available on the Service. Following termination or expiration of this Agreement, Authorized Users may continue to use the Service as individual account users and may only purchase Credits through the Service, subject to Authorized Users' agreement to the OpenRouter Terms of Service. Certain services offered under this Agreement may no longer be available and fees for Credits purchases are subject to the pricing described on the Service website.

6.4 Survival

Sections 2.3, 4, 5 (solely as to outstanding fees), 6.3, 6.4, 7, 9, 10, and 11 will survive termination or expiration of the Agreement.

7. Confidentiality

7.1 Definition of Confidential Information

"Confidential Information" means any information or data disclosed by either party that is marked or otherwise designated as confidential or proprietary or that should otherwise be reasonably understood to be confidential in light of the nature of the information and the circumstances surrounding disclosure. However, "Confidential Information" will not include any information which (a) is publicly available through no fault of receiving party; (b) was properly known to receiving party, without restriction, prior to disclosure by the disclosing party; (c) was properly disclosed to receiving party, without restriction, by another person with the legal authority to do so; or (d) is independently developed by the receiving party without use of or reference to the disclosing party's Confidential Information. Customer Data is Customer's Confidential Information. All software, Documentation and other information provided by OpenRouter as part of the Service is OpenRouter's Confidential Information.

7.2 Confidentiality Obligations

Each party agrees that it will use the Confidential Information of the other party solely in accordance with the provisions of this Agreement and it will not disclose the same directly or indirectly, to any third party without the other party's prior written consent, except as otherwise permitted hereunder. However, either party may disclose Confidential Information (a) to its employees, officers, directors, attorneys, auditors, financial advisors and other representatives who have a need to know and are legally bound to keep such information confidential by confidentiality obligations consistent with those of this Agreement; and (b) as required by law in which case the receiving party will, if permitted under applicable law, provide the disclosing party with prior written notification thereof, will provide the disclosing party with prompt written notice and reasonable assistance to allow the disclosing party to seek a protective order or other appropriate remedy, and will use reasonable efforts to minimize such disclosure to the extent permitted by applicable law. Neither party will disclose the terms of this Agreement to any third party, except that either party may confidentially disclose such terms to actual or potential lenders, investors or acquirers. Each party agrees to exercise due care in protecting the Confidential Information from unauthorized use and disclosure. In the event of actual or threatened breach of the provisions of this Section 7, the non-breaching party will be entitled to seek immediate injunctive and other equitable relief, without waiving any other rights or remedies available to it. Each party will promptly notify the other in writing if it becomes aware of any violations of the confidentiality obligations set forth in this Agreement.

8. Warranties

8.1 Mutual Warranties

Each party represents and warrants to the other that: (a) this Agreement has been duly executed and delivered and constitutes a valid and binding agreement enforceable against such party in accordance with its terms; and (b) no authorization or approval from any third party is required in connection with such party's execution, delivery, or performance of this Agreement.

8.2 Customer Warranties

Customer represents and warrants to OpenRouter that it (a) has all rights or consents necessary to (i) provide Customer Data to OpenRouter under this Agreement; and (ii) if applicable, make the Service available to Customer's End Customers, and (b) in using the Service, will comply with all applicable laws.

8.3 OpenRouter Warranties

OpenRouter represents and warrants to Customer that the Service, when used by Customer in accordance with the permitted uses in this Agreement and the Documentation, will function as described in the Documentation and the DPA, during the Term.

8.4 Exclusive Remedy

Customer shall report to OpenRouter, pursuant to the notice provision of this Agreement, any breach of the warranties set forth in this Section 8. In the event of a breach of warranty by OpenRouter under this Agreement, Customer's sole and exclusive remedy, and OpenRouter's entire liability, shall be prompt correction of any material non-conformance in order to minimize any material adverse effect on Customer's business, or if OpenRouter cannot repair such deficient Service as warranted within sixty (60) days after receipt of written notice of the warranty breach, Customer shall be entitled to terminate the Agreement and recover from OpenRouter a pro-rata portion of the prepaid fees corresponding to the terminated portion of the applicable term.

8.5 Disclaimer

EXCEPT FOR THE EXPRESS REPRESENTATIONS AND WARRANTIES STATED IN THIS SECTION 8, OPENROUTER MAKES NO ADDITIONAL REPRESENTATION OR WARRANTY OF ANY KIND WHETHER EXPRESS, IMPLIED (EITHER IN FACT OR BY OPERATION OF LAW), OR STATUTORY, AS TO ANY MATTER WHATSOEVER. OPENROUTER EXPRESSLY DISCLAIMS ALL IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, QUALITY, ACCURACY, TITLE, AND NON-INFRINGEMENT. OPENROUTER DOES NOT WARRANT AGAINST INTERFERENCE WITH THE ENJOYMENT OF THE SERVICE. OPENROUTER DOES NOT WARRANT THAT THE SERVICE IS ERROR-FREE OR THAT OPERATION OF THE SERVICE WILL BE COMPLETELY SECURE OR UNINTERRUPTED. OPENROUTER DOES NOT WARRANT THAT ANY INFORMATION PROVIDED THROUGH THE SERVICE IS ACCURATE OR COMPLETE, OR THAT ANY INFORMATION PROVIDED THROUGH THE SERVICE WILL ALWAYS BE AVAILABLE. OPENROUTER EXERCISES NO CONTROL OVER AND EXPRESSLY DISCLAIMS ANY LIABILITY ARISING OUT OF OR BASED UPON (A) AVAILABILITY, LATENCY OR UPTIME OF THE AI MODELS; OR (B) USER CONTENT OR THE RESULTS OF CUSTOMER'S USE OF THE SERVICE. CUSTOMER IS SOLELY RESPONSIBLE FOR ALL INPUT, ANY USE OF THE OUTPUT, AND ALL ACTIONS OR OMISSIONS RESULTING THEREFROM.

9. Indemnity

9.1 Indemnity by OpenRouter

OpenRouter will defend, indemnify, and hold harmless Customer against any claim, demand, suit, or proceeding ("Claim") made or brought against Customer by a third party alleging that the use of the Service as permitted hereunder infringes or misappropriates a patent, copyright or trade secret of a third party, except that this indemnity will not apply to any Claims that any Output from an AI Model violates or infringes the rights of any party. If the use of the Service by Customer has become, or in OpenRouter's opinion is likely to become, the subject of any Claim of infringement, OpenRouter may at its option and expense (a) procure for Customer the right to continue using and receiving the Service as set forth hereunder; (b) replace or modify the Service to make it non-infringing (with comparable functionality); or (c) if the options in clauses (a) or (b) are not reasonably practicable, terminate this Agreement and provide a pro rata refund of any prepaid fees corresponding to the terminated portion of the applicable term.

9.1.1 Excluded Claims. OpenRouter will have no liability or obligation with respect to any Claim for intellectual property infringement or misappropriation to the extent such Claim is caused in whole or in part by (a) compliance with designs, guidelines, plans or specifications provided by Customer where alleged infringement would not have occurred but for compliance with such designs, guidelines, plans or specifications; (b) use of the Service by Customer not in accordance with this Agreement; (c) modification of the Service by or on behalf of Customer by a third party where alleged infringement would not have occurred but for such modification; (d) Customer Confidential Information, or (e) the combination, operation or use of the Service with other products or services where the Service would not by itself be infringing but for the combination, operation, or use (clauses (a) through (e), "Excluded Claims"). This Section states OpenRouter's sole and exclusive liability and obligation, and Customer's exclusive remedy, for any Claim of any nature related to infringement or misappropriation of intellectual property.

9.2 Indemnification by Customer

Customer will defend, indemnify, and hold harmless OpenRouter against any Claim made or brought against OpenRouter by a third party arising out of (a) the Excluded Claims; (b) OpenRouter's authorized use of Customer Data as permitted hereunder; (c) User Content; (d) OpenRouter's suspension or termination of, or failure to suspend or terminate, Customer's access to any AI Model; and (e) any uses, acts or omissions by Customer in reliance on any Output.

9.3 Notice and Procedure

In the event of a Claim for which a party seeks indemnity under this Section 9 (each an "Indemnified Party"), (a) the Indemnified Party shall promptly notify the other party ("Indemnifying Party") of such Claim, (b) the Indemnifying Party will have the sole and exclusive authority to defend and/or settle any such Claim (provided that the Indemnifying Party may not settle any Claim without the Indemnified Party's prior written consent, which will not be unreasonably withheld, unless it unconditionally releases the Indemnified Party of all related liability) and (c) the Indemnified Party reasonably cooperates with the Indemnifying Party in connection therewith.

10. Limitation of Liability

EXCEPT FOR EACH PARTY'S INDEMNIFICATION OBLIGATIONS AND FOR BREACH OF SECTION 7 (COLLECTIVELY, "SPECIAL CLAIMS"), UNDER NO LEGAL THEORY, WHETHER IN TORT, CONTRACT, OR OTHERWISE, WILL EITHER PARTY BE LIABLE TO THE OTHER UNDER THIS AGREEMENT FOR (A) ANY INDIRECT, SPECIAL, INCIDENTAL, CONSEQUENTIAL OR PUNITIVE DAMAGES OF ANY CHARACTER, INCLUDING DAMAGES FOR LOSS OF GOODWILL, LOST PROFITS, LOST SALES OR BUSINESS, WORK STOPPAGE, COMPUTER FAILURE OR MALFUNCTION, LOST CONTENT OR DATA, EVEN IF A REPRESENTATIVE OF SUCH PARTY HAS BEEN ADVISED, KNEW OR SHOULD HAVE KNOWN OF THE POSSIBILITY OF SUCH DAMAGES, OR (B) ANY AGGREGATE DAMAGES, COSTS, OR LIABILITIES IN EXCESS OF THE AMOUNTS PAID BY CUSTOMER TO OPENROUTER UNDER THIS AGREEMENT DURING THE TWELVE (12) MONTHS IMMEDIATELY PRECEDING THE EVENT GIVING RISE TO THE CLAIM, EXCLUDING CUSTOMER'S PAYMENT OBLIGATIONS. OPENROUTER'S AGGREGATE LIABILITY FOR SPECIAL CLAIMS UNDER THIS AGREEMENT WILL NOT EXCEED FIVE HUNDRED THOUSAND US DOLLARS ($500,000).

11. Miscellaneous

11.1 Governing Law and Venue

This Agreement will be governed by and interpreted in accordance with the laws of the State of New York, without regard to conflicts of laws principles. In the event of any controversy or claim arising out of or relating to this Agreement, or its breach or interpretation, the parties will submit to the exclusive jurisdiction of and venue in the state and federal courts located in New York County, New York. Each party waives all defenses of lack of personal jurisdiction and inconvenient forum.

11.2 Publicity; References

Customer agrees that OpenRouter may refer to Customer's name and trademarks in OpenRouter's marketing materials and website and subject to Customer's trademark guidelines provided from time to time; however, OpenRouter will not use Customer's name or trademarks in any other publicity (e.g., press releases and customer references) without Customer's prior written consent (which may be by email).

11.3 Equitable Relief

Customer and OpenRouter acknowledge that damages will be an inadequate remedy if the other party violates the terms of this Agreement pertaining to the protection of a party's intellectual property rights and Confidential Information. Accordingly, each of them will have the right, in addition to any other rights each of them may have, to seek in any court of competent jurisdiction, temporary, preliminary, and permanent injunctive relief to restrain any breach, threatened breach, or otherwise to specifically enforce any of the obligations in this Agreement.

11.4 Force Majeure

Neither Party will be deemed in breach hereunder for any cessation, interruption or delay in the performance of its obligations due to causes beyond its reasonable control ("Force Majeure Event"), including earthquake, flood, or other natural disaster, act of God, labor controversy, civil disturbance, terrorism, war (whether or not officially declared), cyber attacks (e.g., denial of service attacks), or the inability to obtain sufficient supplies, transportation, or other essential commodity or service required in the conduct of its business, or any change in or the adoption of any law, regulation, judgment or decree.

11.5 Severability; Invalidity

If any provision of this Agreement is held to be invalid, such invalidity will not render invalid the remainder of this Agreement or the remainder of which such invalid provision is a part. If any provision of this Agreement is so broad as to be held unenforceable, such provision will be interpreted to be only so broad as is enforceable.

11.6 Waiver

No waiver of or with respect to any provision of this Agreement, nor consent by a party to the breach of or departure from any provision of this Agreement, will in any event be binding on or effective against such party unless it be in writing and signed by such party, and then such waiver will be effective only in the specific instance and for the purpose for which given.

11.7 Third Party Beneficiaries

Except as expressly set forth in this Agreement, no provisions of this Agreement are intended nor will be interpreted to provide or create any third party beneficiary rights or any other rights of any kind in any other party.

11.8 Assignment

Neither party may assign any of its rights or obligations under this Agreement without the prior written consent of the other, which will not be unreasonably withheld, provided, however, either party may assign this Agreement to any entity into or with which it is merged, or that acquires all or substantially all of its assets, without requiring consent. Subject to the foregoing restriction on assignment, this Agreement will be binding upon, inure to the benefit of, and be enforceable by the parties and their respective successors and assigns.

11.9 Notices

No notice required or permitted hereunder will be valid unless given in writing and will be deemed to have been validly given only if delivered in person, sent by registered or certified mail, or commercial courier to:

As to OpenRouter: OpenRouter Inc. 169 Madison Ave #2404 New York NY 10016 ATTN: Legal With a copy to [email protected]

As to Customer: The customer entity listed on the Order Form

OpenRouter may provide operational notices regarding the Service or other business-related notices through conspicuous posting of the notice on the Service. Each party consents to receiving electronic notices except for the service of any legal documents, proceedings or notices. OpenRouter is not responsible for any automatic filtering Customer or its network provider may apply to email notifications.

11.10 Subcontractors

OpenRouter may use subcontractors and permit them to exercise the rights granted to OpenRouter in order to provide the Service and related services under this Agreement. These subcontractors may include, for example, OpenRouter's hosting providers. However, subject to all terms and conditions of this Agreement, OpenRouter will remain responsible for: (a) compliance of its subcontractors with the terms of this Agreement; (b) the acts and omissions of its subcontractors; and (c) the overall performance of the Service if and as required under this Agreement. For clarity, AI Model Providers, acting in their capacity as third party model providers, are not subcontractors of OpenRouter.

11.11 Entire Agreement; Amendments

This Agreement, all attached exhibits hereto, and all Order Forms referencing this Agreement constitute the entire agreement and understanding between the parties with respect to the subject matter hereof and supersedes all prior or contemporaneous written, electronic, or oral communications, representations, agreements, or understandings between the parties with respect thereto. This Agreement may not be modified or amended except by a written instrument executed by both parties. Any additional, supplementary, or conflicting terms supplied by either party, including those contained on or within any invoice, purchase order, or standard terms of purchase, or any click through license agreement or terms of use, are specifically and expressly rejected by each party. In the event of conflict between the terms of the Order Form and the Agreement, the terms in the Order Form will take precedence.

11.12 Counterparts

Any amendments to this Agreement may be executed in one or more counterparts, which taken together will constitute a single agreement between the parties.

Exhibit A: Data Processing Agreement

This Data Processing Agreement, including its Schedules, (the "DPA") forms a part of the Enterprise Access Agreement or other written or electronic agreement (the "Agreement") between OpenRouter, Inc. ("OpenRouter") and the customer entity named in the Agreement ("Customer") for the purchase of the Service. By executing the Order Form, Customer hereby also agrees to the terms of this DPA. Customer enters into this DPA on behalf of itself and, to the extent required under applicable Data Protection Laws (defined below), in the name and on behalf of its Affiliates, if and to the extent OpenRouter processes Personal Data (defined below) for which such Affiliates qualify as the Controller (defined below). In the course of providing the Service to Customer pursuant to the Agreement, OpenRouter may Process (defined below) Personal Data on behalf of Customer and the parties agree to comply with the following provisions with respect to any Personal Data, each acting reasonably and in good faith. All capitalized terms not defined in this DPA shall have the meanings set forth in the Agreement.

1. Definitions

1.1 "Affiliate" means any entity that directly or indirectly controls, is controlled by, or is under common control with, another entity.

1.2 "Authorized Affiliate" means any of Customer's Affiliate(s) which (a) is subject to the Data Protection Laws, and (b) is permitted to use the Service pursuant to the Agreement.

1.3 "CCPA" means the California Consumer Privacy Act, Cal. Civ. Code § 1798.100 et seq., as amended by the California Privacy Rights Act, and their implementing regulations.

1.4 "Controller" means the entity which determines the purposes and means of the Processing of Personal Data.

1.5 "Data Protection Impact Assessment" or "DPIA" means an assessment of the impact of the Processing operations on the protection of Personal Data, as described in the GDPR.

1.6 "Data Protection Laws" means all applicable laws and regulations of the European Union, the European Economic Area and their member states (the "EEA"), Switzerland, the United Kingdom and the United States applicable to the Processing of Personal Data under the Agreement, including the GDPR and CCPA.

1.7 "Data Subject" means the identified or identifiable person to whom Personal Data relates.

1.8 "GDPR" means (a) the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) ("EU GDPR") and (b) the EU GDPR as it forms part of the law of England and Wales, Scotland and Northern Ireland by virtue of section 3 of the European Union (Withdrawal) Act 2018 (the "UK GDPR").

1.9 "International Data Transfer" means any transfer of Personal Data from the EEA, Switzerland or the United Kingdom to an international organization or to a country outside of the EEA, Switzerland and the United Kingdom.

1.10 "Personal Data" means any information relating to an identified or identifiable natural person where such data is Customer Data.

1.11 "Processing" means any operation or set of operations which is performed upon Personal Data, whether or not by automatic means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

1.12 "Processor" means the entity which Processes Personal Data on behalf of the Controller, including as applicable any "service provider" as that term is defined by the CCPA.

1.13 "Public Authority" means a government agency or law enforcement authority, including judicial authorities.

1.14 "Standard Contractual Clauses" means Standard Contractual Clauses for the transfer of Personal Data to third countries pursuant to Regulation (EU) 2016/679 of the European Parliament and the Council approved by EC Commission Implementing Decision of 4 June 2021, as currently set out at http://data.europa.eu/eli/dec_impl/2021/914/oj.

1.15 "Subprocessor" means any Processor engaged by OpenRouter or an Affiliate of OpenRouter engaged in the Processing of Personal Data.

1.16 "UK Addendum" means the International Data Transfer Addendum to the Standard Contractual Clauses issued by the UK Information Commissioner's Office, in force as of 21 March 2022, available at https://ico.org.uk/media2/migrated/4019539/international-data-transfer-addendum.pdf.

2. Processing of Personal Data

2.1 Roles of the Parties. The parties acknowledge and agree that with regard to the Processing of Personal Data, Customer is a Controller, and OpenRouter is a Processor.

2.2 Customer's Processing of Personal Data. Customer shall use the Service to Process Personal Data in accordance with the applicable requirements of Data Protection Laws. For the avoidance of doubt, Customer's instructions for the Processing of Personal Data shall comply with Data Protection Laws. Customer shall have sole responsibility for the accuracy, quality, and legality of Personal Data and the means by which Customer acquired Personal Data. Customer is responsible for reviewing the data handling terms set forth in AI Model Terms and configuring Customer's account accordingly.

2.3 OpenRouter's Processing of Personal Data. OpenRouter shall treat Personal Data as Confidential Information and shall Process Personal Data on behalf of and only in accordance with Customer's documented instructions for the following purposes: (i) Processing in accordance with the Agreement; (ii) Processing initiated by Authorized Users in their use of the Service; and (iii) Processing to comply with other documented reasonable instructions provided by Customer (e.g., via email) where such instructions are consistent with the terms of the Agreement.

2.4 Details of the Processing. The subject-matter of Processing of Personal Data by OpenRouter is the performance of the Service pursuant to the Agreement. The duration of the Processing, the nature and purpose of the Processing, the types of Personal Data and categories of Data Subjects Processed under this DPA are further specified in Schedule 1 (Details of Processing) to this DPA.

3. Rights of Data Subjects

OpenRouter shall, to the extent legally permitted, promptly notify Customer of any complaint, dispute or request it has received from a Data Subject such as a Data Subject's right of access, right to rectification, restriction of Processing, erasure ("right to be forgotten"), data portability, objection to the Processing, or its right not to be subject to an automated individual decision making, each such request being a "Data Subject Request". OpenRouter shall not respond to a Data Subject Request itself, except that Customer authorizes OpenRouter to redirect the Data Subject Request as necessary to allow Customer to respond directly. Taking into account the nature of the Processing, OpenRouter shall assist Customer by appropriate technical and organizational measures, insofar as this is possible, for the fulfilment of Customer's obligation to respond to a Data Subject Request under Data Protection Laws. In addition, to the extent Customer, in its use of the Service, does not have the ability to address a Data Subject Request, OpenRouter shall upon Customer's request provide commercially reasonable efforts to assist Customer in responding to such Data Subject Request, to the extent OpenRouter is legally permitted to do so and the response to such Data Subject Request is required under Data Protection Laws. To the extent legally permitted, Customer shall be responsible for any costs arising from OpenRouter's provision of such assistance.

4. OpenRouter Personnel

4.1 Confidentiality. OpenRouter shall ensure that its personnel engaged in the Processing of Personal Data are informed of the confidential nature of the Personal Data, have received appropriate training on their responsibilities and have executed written confidentiality agreements. OpenRouter shall ensure that such confidentiality obligations survive the termination of the personnel engagement.

4.2 Reliability. OpenRouter shall take commercially reasonable steps to ensure the reliability of any OpenRouter personnel engaged in the Processing of Personal Data.

4.3 Limitation of Access. OpenRouter shall ensure that OpenRouter's access to Personal Data is limited to those personnel performing the Service in accordance with the Agreement.

5. Subprocessors

5.1 Appointment of Subprocessors. Customer acknowledges and agrees that (a) OpenRouter's Affiliates may be retained as Subprocessors; and (b) OpenRouter and OpenRouter's Affiliates respectively may engage third-party Subprocessors in connection with the provision of the Service. Prior to providing any access to Personal Data, OpenRouter or a OpenRouter Affiliate has entered into a written agreement with each Subprocessor containing, in substance, data protection obligations no less protective than those in the Agreement with respect to the protection of Personal Data to the extent applicable to the nature of the Service provided by such Subprocessor.

5.2 List of Current Authorized Subprocessors and Notification of New Subprocessors. The current list of authorized Subprocessors that may be engaged in Processing Personal Data, including a description of their authorized processing activities and countries of location, is listed in Schedule 3 (Current List of Authorized Subprocessors). Customer hereby consents to these Subprocessors, their locations and processing activities as it pertains to their Personal Data. Customer can send an email at [email protected] to subscribe to notifications of new Subprocessors, and if Customer subscribes, excluding processing by AI Model Providers, OpenRouter shall provide thirty (30) days notification of a new Subprocessor(s) before authorizing any new Subprocessor(s) to Process Personal Data in connection with the provision of the applicable Service. Customer may configure in Customer's account settings to exclude Processing by certain AI Model Providers.

5.3 Objection Right for New Subprocessors. Customer may object to OpenRouter's use of a new Subprocessor by notifying OpenRouter promptly in writing within thirty (30) days of receipt of OpenRouter's notice in accordance with the mechanism set out in section 5(b). If Customer objects to a new Subprocessor as permitted in the preceding sentence, OpenRouter will use reasonable efforts to make available to Customer a change in the Service or recommend a commercially reasonable change to Customer's configuration or use of the Service to avoid Processing of Personal Data by the objected-to new Subprocessor without unreasonably burdening Customer. If OpenRouter is unable to make available such change within a reasonable period of time, which shall not exceed sixty (60) days, Customer may terminate the Processing with respect only to the aspects of the Service which cannot be provided by OpenRouter without the use of the objected-to new Subprocessor by providing written notice to OpenRouter. OpenRouter will refund Customer any prepaid fees covering the remainder of the Term following the effective date of termination with respect to such terminated Service, without imposing a penalty for such termination on Customer.

5.4 Liability. OpenRouter shall be liable for the acts and omissions of its Subprocessors to the same extent OpenRouter would be liable if performing the services of each Subprocessor directly under the terms of this DPA, unless otherwise set forth in the Agreement.

6. Audit

Upon reasonable request and at Customer's sole expense, OpenRouter will make available to Customer all information necessary to demonstrate compliance with the obligations of this DPA and allow for and contribute to audits, including inspections, as mandated by a Public Authority or reasonably requested, no more than once a year by Customer and performed by an independent auditor as agreed upon by Customer and OpenRouter. The foregoing shall only extend to those documents and facilities relevant and material to the Processing of Personal Data, and shall be conducted during normal business hours and in a manner that causes minimal disruption. OpenRouter will inform Customer if OpenRouter believes that Customer's instruction under this Section infringes Data Protection Laws. OpenRouter may suspend the audit or inspection, or withhold requested information until OpenRouter has modified or confirmed the lawfulness of the instructions in writing.

7. Data Security and Incident Notification

Taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of Processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, OpenRouter will implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including the measures listed in Schedule 2. In addition, OpenRouter maintains security incident management policies and procedures and shall notify Customer without undue delay, and in any case, within seventy-two (72) hours after becoming aware of the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Personal Data transmitted, stored or otherwise Processed by OpenRouter or its Subprocessors (a "Customer Data Incident"). OpenRouter shall make reasonable efforts to identify the cause of such Customer Data Incident and take such steps as OpenRouter deems necessary and reasonable to remediate the cause of such a Customer Data Incident to the extent the remediation is within OpenRouter's reasonable control. The obligations herein shall not apply to incidents that are caused by Customer or Authorized Users.

8. Government Access Requests

In its role as a Processor, OpenRouter shall maintain appropriate measures to protect Personal Data in accordance with the requirements of Data Protection Laws, including by implementing appropriate technical and organizational safeguards to protect Personal Data against any interference that goes beyond what is necessary to safeguard national security, defense and public security. If OpenRouter receives a legally binding request to access Personal Data from a Public Authority, OpenRouter shall, unless otherwise legally prohibited, promptly notify Customer including a summary of the nature of the request. To the extent OpenRouter is prohibited by law from providing such notification, OpenRouter shall use commercially reasonable efforts to obtain a waiver of the prohibition to enable OpenRouter to communicate as much information as possible, as soon as possible. Further, OpenRouter shall challenge the request if, after careful assessment, it concludes that there are reasonable grounds to consider that the request is unlawful. Notwithstanding the above, (a) Customer acknowledges that such challenge may not always be reasonable or possible in light of the nature, scope, context and purposes of the intended government authority access, and (b) this DPA shall not require OpenRouter to pursue action or inaction that could result in civil or criminal penalty for OpenRouter such as contempt of court. In the event OpenRouter does not or cannot challenge the request, OpenRouter shall notify Customer, as soon as possible, following the access by the government authority, and provide Customer with relevant details of the same, unless and to the extent legally prohibited to do so.

9. Return and Deletion of Customer Data

OpenRouter shall return or delete Personal Data in accordance with the procedures and timeframes specified in the Agreement. Until Personal Data is deleted or returned, OpenRouter shall continue to comply with this DPA and its Schedules.

10. Data Protection Impact Assessment

If Customer is required under Data Protection Laws to conduct a Data Protection Impact Assessment, OpenRouter will, upon written request, use commercially reasonable efforts to assist, to the extent Customer does not otherwise have access to the relevant information, including reasonable assistance with any cooperation or prior consultation with supervisory authorities.

11. Authorized Affiliates

11.1 Contractual Relationship. The parties acknowledge and agree that, by executing the DPA, the Customer enters into the DPA on behalf of itself and, as applicable, in the name and on behalf of its Authorized Affiliates, in which case each Authorized Affiliate agrees to be bound by the Customer's obligations under this DPA, if and to the extent that Customer Processes Personal Data on the behalf of such Authorized Affiliates, thus qualifying them as the "Controller."

11.2 Communication. The Customer that is the contracting party to the Agreement shall remain responsible for coordinating all communication with OpenRouter under this DPA and be entitled to make and receive any communication in relation to this DPA on behalf of its Authorized Affiliates.

11.3 Rights of Authorized Affiliates. Where Customer enters into this DPA on behalf of an Authorized Affiliate, such Authorized Affiliate shall, to the extent required under applicable Data Protection Laws, be entitled to exercise the rights and seek remedies under this DPA, subject to the following:

(a) Except where applicable Data Protection Laws require the Authorized Affiliate to exercise a right or seek any remedy under this DPA against OpenRouter directly by itself, the parties agree that (x) solely the Customer that is the contracting party to the Agreement shall exercise any such right or seek any such remedy on behalf of the Authorized Affiliate, and (y) the Customer that is the contracting party to the Agreement shall exercise any such rights under this DPA, not separately for each Authorized Affiliate individually, but in a combined manner for itself and all of its Authorized Affiliates together.

(b) The parties agree that the Customer that is the contracting party to the Agreement shall, when carrying out an on-site audit of the procedures relevant to the protection of Personal Data, take all reasonable measures to limit any impact on OpenRouter and its Subprocessors by combining, to the extent reasonably possible, several audit requests carried out on behalf of itself and all of its Authorized Affiliates in one single audit.

12. Limitation of Liability

Each party's and all of its Affiliates' liability, taken together in the aggregate, arising out of or related to this DPA, whether in contract, tort or under any other theory of liability, is subject to the 'Limitation of Liability' section of the Agreement, and any reference in such section to the liability of a party means the aggregate liability of that party and all of its Affiliates under the Agreement.

13. International Data Transfers

13.1 Authorization. Customer hereby authorizes OpenRouter to carry out International Data Transfers with respect to Personal Data in accordance with Data Protection Laws.

13.2 EEA Transfers. To the extent required under Data Protection Laws for the International Data Transfer of Personal Data originating in the EEA from Customer to OpenRouter, by signing this DPA, Customer and OpenRouter hereby enter into Module 2 (Controller to Processor) of the Standard Contractual Clauses, which are hereby incorporated by reference and completed as follows: the "data exporter" is Customer; the "data importer" is OpenRouter; Clause 9(a) option 2 is implemented and the time period therein is specified as thirty 30 days; the optional redress clause in Clause 11(a) is struck; Clause 17 option 1 is implemented and the governing law is the law of Ireland; the court in Clause 18(b) are the Courts of Dublin, Ireland; Annex 1 and 2 of the Standard Contractual Clauses are Schedule 1 and Schedule 2 to this DPA respectively. To the extent that there is any conflict between the terms of this DPA, the Agreement, and the terms of the Standard Contractual Clauses, the terms of the following documents will prevail (in order of precedence): (i) the Standard Contractual Clauses; (ii) this DPA; and (iii) the Agreement.

13.3 United Kingdom Transfers. The UK Addendum will be applicable to any International Data Transfers originating in the United Kingdom and is completed as follows: for the purpose of table 1 of part 1, the exporter is Customer and the importer is OpenRouter and the table is deemed to be completed with the information set out in Schedule 1. For the purpose of table 2 of part 1, the "Approved EU SCCs" which the UK Addendum is appended to are the Standard Contractual Clauses incorporated into this DPA and completed as set out in the foregoing paragraph. For the purpose of table 3 of part 1, the information requested in Annex 1 and 2 of the Standard Contractual Clauses is provided in Schedule 1 and Schedule 2 to this DPA respectively and the list of Subprocessors is attached as Schedule 3. For the purpose of table 4 of part 1, the importer may end the UK Addendum as set out in section 19 of the UK Addendum.

13.4 Switzerland Transfers. If there is an International Data Transfer subject to Data Protection Laws of Switzerland, then the Standard Contractual Clauses will apply to such International Data Transfer with the following modifications: the competent supervisory authority in Annex I.C under Clause 13 will be the Federal Data Protection and Information Commissioner; references to a "Member State" and "EU Member State" will not be read to prevent Data Subjects in Switzerland from the possibility of suing for their rights in their place of habitual residence (Switzerland); and references to "GDPR" in the Standard Contractual Clauses will be understood as references to Data Protection Laws of Switzerland.

13.5 Change in Data Protection Laws. If OpenRouter's compliance with Data Protection Laws applicable to International Data Transfers is affected by circumstances outside of OpenRouter's control, including circumstances affecting the validity of an applicable legal instrument, OpenRouter and Customer will work together in good faith to reasonably resolve such non-compliance.

14. Miscellaneous

This DPA may only be modified by a written amendment by OpenRouter with notice given to the Customer. If any provision of this DPA is found by any court or administrative body of competent jurisdiction to be invalid or unenforceable, then the invalidity or unenforceability of such provision does not affect any other provision of this DPA and all provisions not affected by such invalidity or unenforceability will remain in full force and effect.

Schedule 1: Details of Processing

A. List of Parties

Name of Data Importer: OpenRouter, Inc.

Address: 169 Madison Ave #2404, New York NY 10016

Contact person's name, position, and contact details: Shashank Goyal, Lead Engineer, [email protected]

Activities relevant to the data transferred under these Clauses: See Schedule 1(B) below and the Agreement.

Signature and date: This Schedule 1 shall automatically be deemed executed when the DPA is executed by OpenRouter.

Role (controller/processor): Processor

Name of Data Exporter: The party identified as the "Customer" in the Agreement.

Address: Reference is made to the Agreement.

Contact person's name, position, and contact details: Reference is made to the Agreement.

Activities relevant to the data transferred under these Clauses: See Schedule 1(B) below and the Agreement.

Signature and date: This Schedule 1 shall automatically be deemed executed when the DPA is executed by Customer.

Role (controller/processor): Controller

B. Description of Processing/Transfer

Categories of Data Subjects whose Personal Data is transferred: Customer's employees and contractors who are Authorized Users.

Categories of Personal Data transferred: Name, contact information, online identifiers (including without limitation, IP address and timestamps, API keys), account/user IDs, any information provided by Authorized Users in unstructured data, and other information necessary to provide the Service under the Agreement.

Sensitive data transferred (if applicable) and applied restrictions or safeguards: No sensitive data is processed under the Agreement.

Frequency of Transfer: Continuous for the duration of the Agreement.

Nature and purpose(s) of the data transfer and Processing: OpenRouter will process Personal Data as necessary to provide the Service under the Agreement.

Retention period (or, if not possible to determine, the criteria used to determine the period): Personal Data will be retained for as long as necessary taking into account the purpose of the Processing, and in compliance with applicable laws, including laws on the statute of limitations and Data Protection Laws.

For transfers to (sub-) processors, also specify subject matter, nature, and duration of the processing: OpenRouter will restrict the onward Subprocessor's access to Personal Data only to what is strictly necessary to provide the Service, and OpenRouter will prohibit the Subprocessor from Processing the Personal Data for any other purpose.

Identify the competent supervisory authority/ies in accordance with Clause 13: Where the EU GDPR applies, the competent supervisory authority shall be designated in accordance with Clause 13 of the EU SCCs. Where the UK GDPR applies, the UK Information Commissioner's Office.

Schedule 2: OpenRouter Security Practices

Information Security Team

An internal OpenRouter group is responsible for enforcing the information and operational security policies, including those in this Schedule. This group currently consists of the CTO, Head of Security, engineers and other security personnel. The team may be contacted at [email protected].

Security Controls

OpenRouter will implement and maintain appropriate technical and organizational measures designed to protect Customer Data against accidental or unlawful destruction, loss, alteration, and unauthorized disclosure of or access to Customer Data processed or transmitted through the Service. Security controls include the following:

• SOC 2 Type II control framework.
• TLS 1.2+ encryption in transit; AES-256 at rest.
• Google Cloud Platform hosting in US regions; data at rest is region-restricted.
• Cloudflare WAF, rate-limiting and DDoS mitigation.
• Role-based access; MFA; least privilege.
• Centralised logging via Datadog; immutable audit logs.
• Quarterly vulnerability scans; annual external penetration test (scheduled Q3 2025).
• Incident response plan in place; breach notifications within 72 hours.
• Business continuity with replicated backups; tested restores.
• Annual security and privacy training; pre-employment background checks.

Incident Management

OpenRouter will maintain incident management policies and procedures designed to promptly investigate, identify, and remediate unauthorized disclosure of Customer Data. In the event of any confirmed or reasonably suspected unauthorized disclosure of Customer Data resulting from a breach of OpenRouter's security obligations, OpenRouter will promptly notify Customer. Upon request from a Customer, OpenRouter will communicate the status and post-mortem details of such an incident.

Data Deletion

Customer may request deletion of Customer Data at any time by emailing [email protected]. OpenRouter deletes Customer Data from the datastores and backups within 30 business days of request and supplies notification of completion via email.

Personnel Practices

All employees with access to technical resources are required to complete security training. When an employee's work relationship with OpenRouter is ending or ends, OpenRouter's operations team revokes access to any proprietary technical systems.

Schedule 3: Current List of Authorized Sub-processors

Available at https://openrouter.ai/authorized-sub-processors.