Data Retention and Logging Policy
Last updated:
Interactive prompts and completions are not stored or logged, and no API content is ever used for training. We keep usage metadata for billing and operations, and batch job data until the retention period below.
Our commitments
- No training: we never use prompts, messages, images, audio, completions, or embeddings to train, fine-tune, distill, or evaluate models, and we never provide them to anyone else for those purposes.
- No content logging: our gateway does not write request or response bodies to logs, analytics, or error reports for chat completions, embeddings, or audio transcription.
- Minimal metadata: we keep the usage fields listed below, which contain no prompt or completion text.
How a request is handled
Your request reaches our API gateway at api.pertoken.ai, which runs on Cloudflare Workers. The gateway checks your API key, selects a GPU server for the model, and forwards the request over an encrypted Cloudflare Tunnel connection. The GPU server is a machine owned by an independent host and rented through Vast.ai, running an open-source inference engine (vLLM for language and embedding models, faster-whisper for audio transcription). The response streams back through the gateway to you. Request content exists only in memory on the gateway and the GPU server while the request is being processed. The inference engine may briefly keep intermediate state (such as a prefix cache) in GPU memory to speed up later requests. This state is not written to disk and is overwritten as the server handles other requests.
If you access PerToken through OpenRouter, OpenRouter forwards your request to the same gateway, and the same handling applies on our side.
What we store and for how long
| Data | Where it lives | What it contains | Retention |
|---|---|---|---|
| Interactive API content (chat completions, embeddings, audio transcription, including images and audio you send) | Memory only, on the gateway and the GPU server | Your inputs and the model outputs | Not stored. Discarded when the request finishes. |
| Batch job inputs and results | Cloudflare Durable Objects storage, one store per batch job | The input lines you submit and the result for each line, so you can download them | [BATCH DATA RETENTION PERIOD] |
| Usage events | Cloudflare Workers Analytics Engine | Request ID, account or workspace ID, API key ID, model, endpoint, serving deployment and provider, HTTP status, token counts (input, output, cached, cache write), audio seconds, latency, streaming, cancellation and mid-stream error flags, priority class, batch job ID and discount, computed charge. No content. | Up to 3 months (Analytics Engine retention) |
| Hourly usage counters | Cloudflare Durable Objects storage | Per-account hourly totals of the same usage fields. No content. | 35 days. Request IDs used to prevent double billing are kept for 36 hours. |
| Hourly usage rollups | Supabase (PostgreSQL) | Per-account hourly totals by model, endpoint, API key, serving deployment, and provider: request counts by status class, token counts, latency totals, and charges. No content. | While your account is open, then [USAGE RECORD RETENTION PERIOD] for billing, tax, and accounting records |
| Account records | Supabase | Name, email address, sign-in records, and workspace approval status and spending cap | While your account is open, then deleted within [ACCOUNT DATA DELETION PERIOD] |
| API key records | Cloudflare Durable Objects storage | SHA-256 hash of the key, key ID, name, short prefix, owner and workspace, scopes, status, and creation, expiry, and revocation times. Never the full key. | While your account is open, including keys you have revoked, then deleted within [ACCOUNT DATA DELETION PERIOD] |
| Gateway platform logs | Cloudflare Workers Logs | Request metadata recorded by the platform, such as time, method, path, status, duration, and Cloudflare network details. The gateway does not log request or response bodies. | Up to 7 days |
| Error reports (when enabled) | Sentry | Stack traces and a small set of diagnostic headers. Authorization and API key headers, request bodies, cookies, query strings, and breadcrumbs are removed before the report leaves the gateway. | [ERROR REPORT RETENTION PERIOD] |
| Support and abuse correspondence | Our email system | Messages you send us | As long as needed to resolve the matter and meet legal obligations |
GPU hosts
Models run on GPU servers owned by independent third parties and rented through the Vast.ai marketplace. We choose hosts that Vast.ai has verified, send traffic to them only over encrypted connections, and do not configure the inference engine to log request content. Because the hardware belongs to a third party, we cannot give the same physical-access guarantees as a dedicated data center. If your use case requires that, contact us before sending sensitive data. When we no longer need a GPU instance, we release it and it is destroyed through Vast.ai.
Model weights are downloaded to GPU servers from Hugging Face. No customer data is sent to Hugging Face.
Deletion requests
To request deletion of your account data, or of a batch job's stored data before its retention period ends, email support@pertoken.ai. Usage and billing records may be kept for the period stated above where the law requires it.
Summary for marketplaces
- Trains on customer data: No.
- Stores prompts or completions for interactive requests: No.
- Logs prompts or completions: No.
- Stores batch job inputs and results: Yes, for [BATCH DATA RETENTION PERIOD], so the customer can retrieve them.
- Usage metadata retained: Yes, as listed above, without content.
- Inference location: third-party GPU hosts rented through Vast.ai.