ISMS CopilotKeep your AI for your own work. Run EU client data on EU models.
For consultants whose clients ask where their data goes. On the -eu models, AI-model processing is done by Mistral AI in the EU (as of 2026-11-09), with compliance knowledge built in.
Call isms-fast-eu or isms-thinking-eu from an EU-hosted or self-hosted client and the AI-model processing stays in the EU, on Mistral AI's EU-bound host (as of 2026-11-09). Same price as the global models.
curl https://api.ismscopilot.com/v1/chat/completions \
-H "Authorization: Bearer sk-isms-..." \
-H "Content-Type: application/json" \
-d '{
"model": "isms-thinking-eu",
"messages": [
{"role": "user", "content": "Review this supplier clause against GDPR Art. 28(3)."}
],
"ismscopilot": { "frameworks": ["GDPR"] }
}'Three ways to work, and what leaves the EU on each
Pick per client, not once for your practice.
- 1. Your AI calls ISMS Copilot over MCP
- What you type goes to your AI's provider first (Anthropic for Claude, OpenAI for ChatGPT), under that provider's terms. For your own work, and for client work where the client's data protection terms permit that provider.
- 2. The API with an -eu model
- From an EU-hosted or self-hosted client (Open WebUI, LibreChat, n8n, LiteLLM, your scripts): AI-model processing by Mistral AI on its EU-bound host. The request still passes through our API runtime in the EU, and its usage metadata goes to our EU-hosted database and logs; those vendors are US companies under SCCs (as of 2026-11-09).
- 3. The ISMS Copilot app with Advanced Data Protection
- Advanced Data Protection is a setting in the ISMS Copilot app. With it on, AI processing is done by Mistral AI only, on its EU endpoint, and your conversations and files are stored in the EU (Frankfurt) as with any app account (as of 2026-11-09). The app's infrastructure vendors are US companies under SCCs; the trust center lists them.
From our own audit preparation
Before an ISO 27001 audit of our own, Claude Code did the file and system work while ISMS Copilot, called over MCP, reviewed the records before they were published. It found inconsistencies between records, of the kind an auditor finds in one read, and a data recipient the draft had missed; we fixed them before publishing, and the decisions stayed ours. This was path 1: what Claude Code sent went to Anthropic first.
What the API path does not cover
The EU path covers the AI-model processing of what you send. Your own client still sends it: if that client is hosted in the US, the request passes there first. The header x-isms-processing-region tells you which mode served the call, as set by the alias; it is not a measurement of the host. The binding record for your client's DPO is the API sub-processor list and the API DPA; the list has its own change-notification terms, and transfer-assessment information is available on request.
Price
- isms-fast-eu, isms-thinking-eu
- $2.80 in, $8.80 out per million tokens, the same as the global models.
- Credits
- Prepaid, from USD 20, with per-key spend caps.
Frequently Asked Questions
Is Claude or ChatGPT not allowed for client work?
That is your client's call and your contract's. Many consultants keep their AI for their own work and use the EU path where a client asks for EU processing. This page does not tell you to stop using your AI.
Which model runs on the EU path?
GLM 5.3 hosted by Mistral AI today. A kill switch can serve Mistral Small on the same EU host; the alias stays the same (as of 2026-11-09). GLM 5.3 is an open-weights model of Chinese authorship; Mistral AI serves it in the EU and the model author receives no request content.
Is anything stored?
Request content is not kept as a record in our API data layer and is not used to train any model. Usage and billing metadata (model, tokens, cost, timestamps) are kept for billing and security.
Can I connect Open WebUI, LibreChat or n8n?
Yes, as an OpenAI-compatible text-only provider with base URL https://api.ismscopilot.com/v1 and the -eu model ids. Setup guides