Requesty vs. OpenRouter: an EU LLM gateway that makes GDPR easier—not automatic
Requesty gives European teams something they often seek too late in an LLM gateway: one API for multiple models, with a way to keep routing and selected inference endpoints inside the EU. That is a much better starting point than wiring OpenAI, Anthropic, Google, and Mistral directly into every workflow and only later asking where prompts from CRM, invoices, or support actually travel.
The critical correction comes first: no LLM gateway makes a company automatically GDPR-compliant. Requesty can materially reduce architectural and contractual risk. You still remain the controller: define purpose and lawful basis, decide what may enter the model, sign contracts, manage access, and assess high-risk use cases. That distinction is the difference between a workable system and a false sense of safety.
What Requesty offers an EU team
For its EU offering, Requesty documents the ’https://router.eu.requesty.ai/v1’ endpoint, routing in AWS Frankfurt, zero retention of request/response bodies, and a DPA on request. The phrase “EU-region model deployments” matters: changing only the base URL is not enough. Your policy must select a provider’s specific European deployment; otherwise an EU gateway does not automatically make the inference path European.
The API is OpenAI-compatible. In n8n, Make, or an internal Node/Python agent, the practical migration is usually a base URL, API key, and model change. Requesty adds routing, fallbacks, caching, budget caps, observability, PII scrubbing, and prompt-injection protection. It is a useful operating layer: use project-specific gateway keys, allow only approved models, and inspect cost and failure patterns centrally.
Zero retention at a gateway does not solve what your own application stores. If n8n persists execution data, a tracing platform stores prompts, or a team copies full tickets into Slack, sensitive data remains outside Requesty. PII scrubbing is not a substitute for data minimisation either: for health, HR, or financial data, send only pseudonymised fields that are necessary for the task.
Requesty vs. OpenRouter
| Question | Requesty | OpenRouter |
|---|---|---|
| EU by default | EU endpoint, Frankfurt, DPA, and EU-region models are core to the product. | EU in-region routing exists, but the documentation describes it as an enterprise feature enabled on request. Without it, the privacy policy allows personal data to be transferred to the US or other countries. |
| Privacy and retention | Requesty states zero retention for request/response bodies and metadata-only observability on its EU gateway. | ZDR can be enforced globally, with guardrails, or per request; prompt logging is off by default but must stay off. |
| Breadth | The website lists 400+ models and 20+ providers, including EU regional variants. | Its pricing page lists 400+ models and 70+ providers: a broader selection and generally more mature global routing. |
| Governance | Routing policies, budget caps, PII scrubbing, RBAC/SSO, and enterprise SLA. | Guardrails for model/provider allowlists, ZDR, DLP, budgets, and content filters; strong workspace-level controls. |
| When to choose it | You want an EU architecture from day one without building it as an expensive add-on. | You want the widest provider choice, global coverage, or already use OpenRouter governance and can buy enterprise EU routing. |
OpenRouter is not “non-GDPR”. Its documentation offers a DPA, ZDR, data-policy filters, allowlists, and an enterprise EU endpoint. For a standard European company, however, Requesty is easier to explain to an auditor: EU URL, DPA, zero retention, and regional models are presented together. OpenRouter requires more features to be actively purchased and locked down. That is operational ergonomics, not an absolute legal verdict.
Price: compare gateway economics, not only the model list price
Both services combine upstream model cost with gateway economics. Requesty’s main pricing page says 5% markup above model cost, with no seats or minimums. OpenRouter’s pay-as-you-go pricing says 5.5% platform fee, while its FAQ describes model inference as passthrough and a fee on credit purchase. The practical result: before signing, obtain confirmation of the all-in cost for a specific model, region, payment method, and BYOK setup.
There is one procurement detail worth keeping visible: some Requesty regional model pages state provider list price without markup, which conflicts with the general 5% pricing page. Treat neither marketing sentence as your contract price. Put the exact model/region, input/output/cached-token price, cache and tool-call cost, currency, invoice terms, and budget cap into the order. EU variants can differ from global availability and pricing for the same model.
The configuration that turns an EU gateway into actual control
Classify data. Initially prohibit direct identifiers, passwords, payment details, health data, HR evaluations, and full CRM exports from prompts. For support classification, send a ticket ID and scrubbed text, not a full customer profile.
Use only the EU base URL and an EU model allowlist. In Requesty, use the EU endpoint and named regional deployments. Permit automatic fallback only between models that have passed the same region and contract review. Falling back to the cheapest globally available provider is the wrong EU default.
Sign a DPA and inspect subprocessors. You need a DPA with the gateway and every other processor that actually sees the data. Store the DPA version, subprocessors, processing location, deletion terms, and incident contact. GDPR Article 28 requires processors with sufficient safeguards; Article 44 also governs onward transfers outside the EEA.
Make privacy the application default. Do not store prompts in observability unless the use case needs it. Log request ID, model, region, input class/hash, token count, cost, routing decision, and validation result instead. Put keys in a secrets manager, separate dev/stage/prod, and restrict models and spend per key.
Add a PII filter before the LLM and an audit after it. Mask email, phone, national IDs, bank accounts, and internal identifiers before sending. Validate output with JSON Schema, do not automatically act on decisions with significant effects on people, and give a human reviewer sources or reasons.
Assess whether a DPIA is required. A meeting-summary workflow may not need one. Evaluate it, however, for large-scale sensitive data, profiling, biometrics, or automated decisions with legal or similarly significant effects. EDPB notes that a DPIA is required before processing likely to create a high risk to people’s rights.
Test and evidence it. Add an integration test that rejects a global URL or model outside the allowlist. Each quarter, re-check endpoint region, subprocessors, retention, fallback policy, and a sample of real prompts. This is far more credible than a compliance claim in a slide deck.
A sensible first pilot
Do not start with a customer chatbot or HR screening. Pick a real but low-risk process: classification of anonymised support tickets, extraction from unsigned supplier documents, or an internal release-memo draft. Create two keys: ’eu-low-risk’ with a low-cost EU model, and ’eu-review’ with a stronger EU model only for human-approved escalations. Both keys get a spend cap, allowlist, PII policy, and metadata-only logging.
After two weeks, do not measure tokens alone. Measure approved outputs, PII caught by the filter, fallback frequency, who had access to keys, whether prompt bodies were stored anywhere, and whether you can export an audit for one specific decision. Then extend the use case instead of merely calling a more expensive model.
The takeaway
Requesty is a strong LLM-gateway candidate for a European company because it bundles EU data residency, a DPA, zero retention, and regional routing. Compared with OpenRouter, its key advantage is that the EU path is not hidden as an enterprise add-on. It is weaker on global ecosystem breadth and requires careful verification of the exact price and model region.
Buy a controllable system, not a “GDPR compliant AI” slogan: EU endpoint, approved EU deployments, DPA, limited logging, data minimisation, human review, and recurring audit. That is how Requesty becomes both an easy sell and a defensible deployment.
This is a technical and operational guide, not legal advice. In sensitive or high-risk use cases, involve your DPO or legal counsel.
Sources: Requesty EU Data Residency, DPA, pricing and AI Gateway; OpenRouter pricing, Sovereign AI, Zero Data Retention, privacy policy and Input & Output Logging; GDPR on EUR-Lex and EDPB DPIA guidance.