ISMS CopilotModels, prices and where your data goes.
Every model the API serves, what it costs, its limits, and what happens to the data on each path.
Models and prices
Prices exclude VAT, as listed on 2026-11-09 and checked against the product. The console is the billing source of truth; GET /v1/models lists the models your key can call.
- isms-fast
- Global path. GLM 5.3. $2.80 in, $8.80 out per million tokens.
- isms-thinking
- Global path. GLM 5.3. $2.80 in, $8.80 out per million tokens.
- isms-fast-eu
- EU path. GLM 5.3 hosted by Mistral today. $2.80 in, $8.80 out per million tokens.
- isms-thinking-eu
- EU path. GLM 5.3 hosted by Mistral today. $2.80 in, $8.80 out per million tokens.
- isms-mini
- Global path. GLM-5.3-Flash. $0.50 in, $2.00 out per million tokens.
Credits and limits
- Credits
- Prepaid, from USD 20. While the offer runs, a new API account can get a one-time USD 2 credit when it creates its first key. It is one per person, and accounts that sign in only with Microsoft do not qualify.
- Spend caps
- Optional, per key: set one and an unattended loop stops near it.
- Context
- 128,000 tokens per request, including the injected framework modules.
- Rate limit
- 120 requests per minute per key (default).
Where your data goes, per path
As configured on 2026-11-09. The alias you send picks the path; the response header x-isms-processing-region confirms the mode, not the physical host. If this page and the sub-processor list ever differ, the list is the binding record.
- EU path (isms-fast-eu, isms-thinking-eu)
- AI-model processing of your request content is done only by Mistral AI (France) on its EU-bound host, under the commercial ZDR agreement, with no transfer of AI-model processing outside the EEA. The request still passes through the infrastructure on every path (below).
- Global path (isms-fast, isms-thinking, isms-mini)
- Received by OpenRouter (US) and served on a closed set of three hosts: Together AI (US), Fireworks AI (US), Inceptron (Sweden). OpenRouter is set to zero data retention at account level and on every request, so request content is not retained beyond serving the request (transient in-memory caching can occur during processing). The per-request region is not pinned, so treat this path as a transfer to and processing in the US.
- On every path
- API runtime on Fly.io in the EU, metadata database on Supabase in the EU, error monitoring on Sentry with EU ingest, logs on Axiom in Frankfurt (30 days). These vendors are US companies under SCCs. Billing by Stripe (Stripe Payments Europe and Stripe, Inc.), which sees billing data, not request content.
- Retention
- Request content and outputs are not kept as records in our API data layer. Error monitoring drops request bodies, and logs are not meant to contain request content. Your content is not used to train any model. We keep usage and billing metadata (model, tokens, cost, timestamps, key and account identifiers) as an independent controller, for metering, billing, fraud prevention, security, and accounting and tax obligations, as the API DPA sets out.
Terms and records
- API sub-processor list
Effective 2026-10-20, the binding list for the API
- API DPA
Data processing terms for what you send
- Zero data retention in the docs
What is and is not stored
- Zero data retention vs EU residency
Two different guarantees, explained
- EU data sovereignty
For the app as a whole
Frequently Asked Questions
Is the global path ever in the EU?
No. Every global request is first received by OpenRouter in the US. Inference can then run on any of the three hosts, including Inceptron in Sweden, but you cannot choose that, so treat the global path as processed in the US. If a request must be processed in the EU, call an -eu alias.
Is isms-mini available on the EU path?
No. isms-mini is global only.
Why do the -eu aliases cost the same as the global ones?
One price for the four standard aliases, so the path is a data decision, not a budget one.