What happens in flight
Your request is received at our edge, authenticated, checked against your limits, and forwarded to the provider. The response streams back through us to you. That means request and response bodies do exist in our process memory for the duration of the call — this is unavoidable for a proxy, and any proxy claiming otherwise is being imprecise with you.
What is avoidable is persistence. Bodies are never written to disk, never placed on a queue, and never retained after the response completes.
What we retain
| Data | Retained | Why |
|---|---|---|
| Request and response bodies | Not retained | Unless you enable per-key logging |
| Token counts and cost | 24 months | Billing, and your usage endpoint |
| Model, timestamp, latency | 24 months | Billing disputes and support |
| Request ID and key ID | 24 months | Tracing a specific call |
| Client IP | 30 days | Abuse prevention |
| Opt-in request logs | 30 days, then deleted | Only for keys where you turned it on |
We do not train on anything. Not prompts, not completions, not metadata. There is nothing to train — we do not have model weights and are not in that business.
Where it runs
- Our infrastructure runs in [US-EAST-1 / US-WEST-2], in the United States.
- Upstream calls go to US provider endpoints under zero-retention terms where the provider offers them.
- No request or response data routes through China, and no subprocessor of ours operates there.
- Support staff can see metadata — cost, latency, model, request ID — and cannot see request bodies unless you have enabled logging on that key and explicitly ask us to look.
Subprocessors
The current list is maintained at /legal/subprocessors and we give 30 days’ notice before adding one. If you need a signed DPA, a security questionnaire completed, or a zero-retention attestation for your compliance team, email security and a human will handle it.