Openrouter Compliance Review

Overview

This skill provides a framework for reviewing your OpenRouter integration against security, privacy, and regulatory compliance requirements.

Prerequisites

• OpenRouter integration in use
• Compliance requirements documented (SOC2, GDPR, HIPAA, etc.)

Instructions

1. Inventory data flows: Map every place where data enters and exits the OpenRouter API — prompts, responses, headers, and logs — to understand your data exposure surface
2. Review key management: Verify API keys are stored in environment variables or a secrets manager (never in code), rotated on a schedule, and scoped to minimum required permissions
3. Check data residency: Confirm that the models and providers you use process data in regions that comply with your regulatory requirements (check OpenRouter's data processing docs)
4. Validate logging practices: Ensure audit logs capture required events without storing sensitive content; verify PII redaction and log retention policies
5. Document and remediate: Produce a compliance checklist with pass/fail status for each item; create tickets for any findings that need remediation

Output

• Data flow diagram showing all touchpoints with the OpenRouter API
• Compliance checklist with pass/fail status for each requirement
• Remediation action items with priority and assignee

Error Handling

See ${CLAUDE_SKILL_DIR}/references/errors.md for full error reference.

Examples

See ${CLAUDE_SKILL_DIR}/references/examples.md for runnable code samples.

Resources

• OpenRouter Documentation
• OpenRouter Models
• OpenRouter API Reference
• OpenRouter Status