Home › Docs › Security and data residency
Control and visibilitySecurity and data residency
Your prompts and outputs pass straight through by default. Here is exactly what we keep, what we never keep, and where it runs.
Prompts and outputs pass through to your model providers and are not stored. Only request metadata is logged.
If you switch it on for a route, its cached responses are kept only until they expire.
Model providers apply their own retention policies to the requests they receive. Routing uses only providers you approve, so you can pick ones whose terms fit your requirements.
Choose where your requests are processed, and routing keeps them there.
Control who on your team can access keys, routes and reports.
For regulated workloads, the gateway can run in your own cloud. Available on request.
Authorized API supply, lawful resale where applicable, and clear data-handling terms.
Requests to the gateway travel over HTTPS (TLS).
Nothing you send is used to train models.
A mutual NDA before kickoff, and a Data Processing Agreement on request.
Our audit is underway. See the Trust Center for every control and its status.
How logging, caching and provider retention fit together
- apicuts logs request metadata only: timestamp, model, provider, token counts, latency and cost.
- Semantic caching is off unless you switch it on for a route, and cached responses expire.
- Model providers each apply their own retention policy to the requests they receive. You choose which providers your traffic may use.
Want us to find your 20%?
Book a free 15-minute API cost teardown. Bring last month's provider usage and we'll show you your biggest waste and the first fix we'd ship.
Get a Free 15-Minute API Cost Teardown