Where your requests go: provider labels, image marking and privacy updates
Every model page now shows where each provider is based and flags countries without EU data protection safeguards. Here is what the labels mean, how to choose your route, and what else changed.
A question from our Discord: why do so many providers on a model page carry a red warning sign? Fair question. This post explains the new labels, what they mean for your data, and how to pick the route you are comfortable with.
What the labels mean
Most models on UnoRouter are served by several provider groups. Each group now shows a flag for the country where the provider is based. A red warning sign means that country has no data protection safeguard recognised by the European Union: no adequacy decision and no standard contractual clauses. Today that mostly means providers in China and Hong Kong. The warning does not say a provider misuses data. It says we cannot give you the legal guarantee EU law expects for that route.
Storage and training
For every provider we also record whether it stores prompts or trains on them. Where a provider publishes a clear policy, the label shows it. For many gateways we simply cannot verify what happens on their side, so the label says unknown instead of guessing. We would rather tell you that we do not know than promise something we cannot check.
How to choose your route
Honest answer first: today most text models are only available through routes that carry the warning, because they are a lot cheaper. Where a route without the warning exists, for example Gemini 3.5 Flash directly from Google or the image models served by Runware, you can pin it. Open your API key settings, pick the model and select the groups you want; a pinned key only uses those groups. The labels are visible on every model in the model catalog, and we will add more routes without a warning over time.
Our advice
Do not send personal data of other people through a route with a warning sign, and think twice before sending your own. For code, creative writing and roleplay without real names this is usually not a concern. If you use UnoRouter for a company, tell us when you sign up: business use comes with stricter rules, and we are building a set of routes that meets them.
AI images and videos are now labeled
From December 2026 the EU AI Act requires generated images and videos to be marked as AI generated in a machine readable way. UnoRouter now adds this mark to every image and video it delivers, as standard metadata inside the file. Nothing visible changes and the image is not re-encoded, so quality stays exactly the same. Marks that a provider already embedded are kept untouched.
Also new
Our privacy policy now names the countries your requests can be routed to and the legal basis for each. The site has an imprint. Setting up two factor authentication works again after a bug that blocked it, and sensitive account changes now ask you to confirm it is really you.
Questions about a specific provider? Ask in our Discord or check the labels on the model pages.
For four days we served LoreBary's in-house model without permission. Here is what happened, what we changed, and exactly what UnoRouter keeps about you.
ai-model-verifier is the engine behind our model tester, published on npm under AGPL-3.0. Give it a base URL, a key and a model and it tells you whether the endpoint serves what it sells, now with thinking-signature and token-billing checks.
We wired about 50 free providers into UnoRouter: 130+ free models, one OpenAI-compatible endpoint, $0 per token. They carry upstream limits we cannot raise, plus a light 1-per-minute cap we add to keep the shared pools fair. Here is the honest version.