AW-1Airworthy certification
Self-declared
isn't verified.
Every inference provider publishes claims about training, retention and where it operates. Airworthy tells you which ones are true. We check each claim against contracts, registries and audit reports, then stamp the provider page with exactly what we verified.
For carriers listed on Airside. Valid 12 months. The stamp comes off when a claim changes.
- 1. Carrier
- EMBERCLOUD INFERENCE
- 2. Legal entity
- Embercloud Labs B.V.
- 3. Headquarters
- NL — Netherlands
- 4. Trains on API data
- NO
- 5. Logs prompts
- NO
- 6. Retention
- ZERO DAYS
- 7. GDPR
- DPA + SCCs
- 8. SOC 2
- TYPE II
- 9. ISO 27001
- CERTIFIED
The standard
Eight claims. Each one checked against paper.
AW-1 covers the promises developers and compliance teams actually ask about before sending a prompt to a new provider. A claim that can't be backed by a document doesn't make it onto the certificate.
Data handling
What happens to a prompt after it leaves the gateway.
- AW-1.D1“Whether API data trains models.”The training clause in the signed DPA or the terms of service.
- AW-1.D2“Whether prompts are logged.”The logging scope in the DPA or privacy policy.
- AW-1.D3“How long prompts are kept.”The retention period in the DPA. A zero-retention claim needs written confirmation.
Jurisdiction
Whose laws the provider answers to.
- AW-1.J1“Which legal entity operates the API.”A corporate registry extract that matches the contracting party.
- AW-1.J2“Where it is headquartered.”The registered address in that registry.
Assurance
Audits that exist on paper, not only as a logo.
- AW-1.A1“SOC 2 Type I or Type II, if claimed.”A current report, with its period ending in the last 12 months.
- AW-1.A2“ISO/IEC 27001, if claimed.”The certificate, checked with the body that issued it.
- AW-1.A3“GDPR readiness, if claimed.”A published DPA with standard contractual clauses, or an EU establishment.
Flight plan
From profile to stamp
- 01
File the profile
List as a carrier on Airside and complete the public profile: legal entity, headquarters, training, logging, retention and audits. These are the claims we inspect.
- 02
Inspection
Send the evidence: DPA, terms, registry extract, audit reports. An LLM Gateway reviewer checks every claim against it and records what was seen.
- 03
Certificate issued
You get a numbered AW-1 certificate, valid for 12 months. The stamp goes on your provider page on llmgateway.io and into the public registry below.
- 04
Stays true or comes off
The certificate freezes the claims it attests. Change one on your profile and the stamp comes off on its own. It only returns if the profile matches the certificate again; new values need a new inspection. No stale badges.
Public registry
Cleared carriers
Certificates in force, with the values we verified, refreshed every minute. A stamp means the stated policy is true, not that it is zero retention, so check the values against your own requirements.
The first inspections are underway. Certified carriers appear here within a minute of their certificate being issued.
Where it fits
Audits cover the company. Airworthy covers your prompts.
| Self-declared profile | SOC 2 / ISO 27001 | Airworthy AW-1 | |
|---|---|---|---|
| Who checks it | Nobody | An independent auditor | LLM Gateway reviewers |
| Says whether prompts train models | Claimed | Usually out of scope | Checked against the DPA |
| Says how long prompts are kept | Claimed | Rarely in scope | Checked against the DPA |
| Confirms headquarters and entity | Claimed | Named in the report | Checked against the registry |
| Shown where you pick a provider | Yes | Behind an NDA | On the provider page |
| When the claim changes | Edited silently | Next audit cycle | Stamp comes off within a minute |
For developers and compliance teams
Pick a provider without a security questionnaire.
The stamp on a provider page means someone read the DPA so you don't have to. The certificate number tells your reviewer exactly which claims were checked and until when.
Browse providersFor carriers
Turn your privacy policy into a selling point.
You already did the work: the DPA, the retention policy, the audit. Airworthy puts it on your provider page in a form a buyer can trust at a glance.
Request an inspectionInspection questions
- What does Airworthy certify?
- That the provider's public claims about AI training on API data, prompt logging, data retention, legal entity, headquarters, GDPR, SOC 2 and ISO 27001 match the evidence LLM Gateway reviewed. Each certificate lists exactly which claims it attests.
- Does the stamp mean zero retention and no training?
- No. The stamp means the provider's stated policy is true, whatever it is. A provider that keeps prompts for 30 days can be certified, as long as 30 days is what it says and what its DPA commits to. The registry and every certificate list the verified values, so check them against your own requirements.
- Is Airworthy a replacement for SOC 2 or ISO 27001?
- No. Those audit a company's security controls. Airworthy checks the specific promises an inference API makes about your prompts and where it operates, and it confirms that any SOC 2 or ISO 27001 claim is backed by a current report or certificate.
- Who can be certified?
- Any carrier listed on Airside with a complete public profile. Catalogue providers and custom carriers go through the same inspection.
- How long is a certificate valid?
- Twelve months from issue, unless LLM Gateway revokes it sooner. While a carrier's profile differs from what the certificate attests, the stamp is hidden from its provider page, within a minute of the change. New values need a new inspection.
- How do I check a certificate?
- Every valid certificate is listed in the registry on this page with its number and expiry, and the same number is printed on the stamp on the provider page.
- How do we apply?
- List your carrier on Airside, complete your profile, then request an inspection. We will tell you which documents to send.
Prove it once. Wear the stamp.
Not listed yet? Claim your carrier first, then request an inspection from the same team that reviews your fares.