// Life of a request01
Processed,
not retained.
Auth, policy and budget resolve against hot state. Your prompt is translated for the chosen upstream, streamed back, and never written down as content.
Trust & securityEuropean by default,
European by default,
and provable.
Residency, retention and provenance are properties of your key, enforced on every request, not clauses you negotiate into a contract and then take on faith.
// Four commitments
What we do with your data.
Residency is getting more expensive elsewhere: since 1 September 2026 one major hyperscaler charges 20% more for its EU data zone, and 30% to 50% to pin a single European region. With EU-only routing you set it as a policy on a key instead.
Zero data retention
We do not store prompt or output content and we do not log it. Every artifact carries a data class and every request carries a retention class, and an hourly purge checks that each sink honoured them.
No training on your traffic
Your prompts and generations are not training data, not for us and not shared onward for that purpose. This is a property of the key, set once and enforced per request.
EU or global routing
Leave a key global, or pin it to EU routes and inference stays on them. A request that cannot be served in region fails closed. Residency is a policy you set, not a tier you buy.
Provenance on request
Add sign=true and generated media returns with a C2PA manifest and a watermark, signed in the same call. Provenance stops being a separate pipeline you have to reconcile.
Processed,
// Data sovereignty02
In region,
or not at all.
A key pinned to EU routes is checked before dispatch, not after. When no in-region endpoint can serve the request, it fails closed rather than quietly crossing a border.
// Provenance03
Signed in the
same call.
A Content Passport, meaning a C2PA manifest plus a watermark, attached to generated media at the moment it is made rather than bolted on by a second system afterwards.
// In practice
How the controls actually work.
Keys are the control surface
- Spend limit, expiry and model allowlist per key
- Routing and residency policy bound to the key
- Budget reserved pre-dispatch, settled post-generation
- Rotate or revoke without touching your code
Retention is provable
- Data class per artifact, retention class per request
- Hourly purge proof across every storage sink
- Signed snapshots of policy state
- Audit logs available on committed-use accounts
Isolation and transport
- TLS in transit, encryption at rest for async media
- Signed, expiring URLs for generated artifacts
- Tenant isolation on keys, budgets and rate limits
- Per-key rate limiting and circuit breaking
Security review, DPA or questionnaire?
Write to [email protected] and we will send the current pack: sub-processor list, data flow, retention model and the DPA.