Zero data retention
What is kept, what is never written, and how to check.
Prompts, messages, system prompts, completions, tool-call arguments and embedding inputs exist in gateway memory only for the life of a request. Nothing persists them: no table has a column for content, and the gateway's logger drops content-bearing fields before a line is written.
Kept per request
| Field | Why |
|---|---|
| Timestamp, request id | Support and debugging |
| Key id, model, endpoint, stream flag, status | Usage views and limits |
| Prompt, cached and completion token counts; cost | Billing |
| Latency | Status and performance views |
| Policy reference and decision codes | Audit of what your guardrails did |
Decision codes name classifiers and counts (redacted=2), never the matched text.
Elsewhere in the system
- Model servers hold the request in memory while generating. They do not log content.
- External classifiers receive text to classify. Run them inside the same trust boundary and under the same rule.
- Chat keeps history in your browser's local storage. There is no server-side chat history.
- Prompt caching on the model server keys on token prefixes in GPU memory for the life of the process; it is not a store and cannot be read back.
Verify it
The dashboard's usage detail shows every field we hold for a request. If you self-host, the usage_events table is the complete list. Retention commitments are also stated in the privacy policy.
Spot an error or a gap? Tell us — and quote x-request-id if you have one.