From gateway to upstream vendor: the technical controls that ensure no prompt, audio, or document ever enters a training set.
Zero retention is a claim that only means something if you can describe the mechanism. Here is the full path a request takes and every place data could persist — along with what stops it.
At the gateway
Request bodies live in memory for the duration of the call and are never written to disk. Logs record metadata only: model, token counts, latency, status. Prompt and completion text are excluded at the serializer, not filtered afterwards, so there is no window in which they exist in a log buffer.
In transit to vendors
- TLS 1.3 to every upstream, certificate pinning on all frontier providers
- Zero-retention contractual terms with each vendor, enforced by API flag where one exists
- Training opt-out asserted per request, never relying on an account-level default
Caching is the exception, and it is yours
Semantic cache entries do persist, because that is the point. They are encrypted per tenant, never shared across tenants, expire on the TTL you set, and can be purged on demand. Caching is off by default for any route you mark as sensitive.
No prompt, audio file, or document processed through the gateway has ever entered a training set — ours or a vendor's. There is no pipeline that could carry it there.
Verifying it yourself
Every response includes a retention block stating what was stored and where. Enterprise tenants get quarterly third-party audit reports and can request a data-flow review with our security team.