Privacy & retention

Zero prompt retention is a design contract, not a setting.

What is never stored

Request and response bodies are never persisted or logged anywhere in the pipeline. This is enforced by an end-to-end test that greps logs for a sentinel value, so a regression fails CI.

Because of this, the gateway cannot replay a prompt. Do not build anything that assumes it can — there is no server-side history of your inputs or model outputs.

What is stored

Only metadata survives a request:

• Token counts (prompt / completion / total)
• Latency and HTTP status
• Model id and computed cost

This metadata powers billing, usage analytics, and rate limiting — none of it contains your prompt or the model’s response.

Data residency

Requests are served by EU-resident providers. Each model’s sovereignty tier tells you whether the provider is EU-owned (strict) or an EU region of a non-EU parent (pragmatic), so you can enforce the residency guarantee your use case requires.