Scoped credentials
Keys with explicit permissions, attribution, budgets, and expiry. Separate key boundaries for the gateway, devices, and contribution vault.
Trust & privacy
Your work deserves
clear boundaries.
Consent should be visible in the product, the request path, and the record of what happened. Here is how we’re designing those boundaries—and what they mean in practice.
Private by defaultVerifiable provenance, plannedIndependent audit: not completed
POLICY TRAVELS WITH THE REQUEST.
Inspect context, enforce the rules and trace the path. Enterprise controls are designed to protect work through the full input and output flow.
The data map
What goes where.
The table below describes the planned platform architecture. Retention values are proposed and will be finalized in the launch policy.
| Data category | Planned handling | Proposed retention / control |
|---|---|---|
| Private prompts & responsesContent needed for inference | Transit through the gateway to the selected provider. No storage of bodies by OptinRouter. | Not retained by the gateway. Provider terms apply separately. |
| Request metadataTokens, route, cost, timestamps | Operational storage for usage, billing, and reliability. | 90 days hot storage; up to 24 months for analytics, then aggregated. |
| Local session historyWhen the daemon is enabled | Held on your machine, under your local settings. | User-controlled retention and deletion. |
| Optional commitmentsCryptographic evidence | Salted commitments with salts sealed to device keys. Designed to verify later submissions. | Proposed 104-day commitment window; signed tree heads retained. |
| Submitted sessionsAfter explicit selection or within an accepted program’s scope | A separate encrypted vault with its own access boundaries. | Review and deletion before listing; final retention and review windows published with the program. |
| Licensed recordsAfter an accepted offer and delivery | Delivered under recipient and use restrictions recorded in a license. | Contractual retention and takedown obligations. Buyer copies cannot be technically recalled. |
Protection by design
Separate systems.
Deliberate access.
The serving path and contribution vault are designed as separate data planes. Private inference remains available without capture or sale permission. A funded data-discount route requires its separate accepted agreement before qualifying use.
Protection on your machine
The planned daemon filters secrets before inference and runs stricter checks before a contribution upload. Hosted mode does not provide local redaction.
Policies before preferences
Organization rules, supplier terms, region requirements, and price limits determine eligible routes before health, latency, or cost are scored.
Limits, in plain language
Trust includes saying where
the boundary ends.
Inference needs your input.
Private does not mean the model provider never sees a prompt. Provider retention and processing terms remain relevant to every route.
A signature proves a path.
Provenance can establish the integrity and origin of recorded bytes. It does not prove a human wrote every line or that the work is correct.
A delivered copy is a copy.
Before licensing, planned review controls let you withdraw. After delivery, takedowns depend on contractual obligations; copies cannot be recalled by software.
Has OptinRouter completed a security audit?
No independent security audit or third-party certification is claimed for this preview. Security review, published policies, and release readiness checks are prerequisites for the relevant platform features.
Does Private mean zero data retention everywhere?
No. The design calls for no OptinRouter storage of Private prompt or response bodies, while retaining operational metadata. Your selected model provider has its own data-handling terms. Routes requiring provider zero-retention support must be checked against those terms and capabilities.
Can I withdraw a contributed session?
The planned workflow supports holding or deleting a session before it is licensed and delivered. After a buyer receives data, a takedown can be issued under the contract, but OptinRouter cannot technically recall that buyer’s copy. This limit belongs at the submission decision, not in a hidden footnote.
Where can I ask a security question?
Use the contact form and describe your security question in the message. Please describe the concern without sending passwords, API keys, private source code, or exploit payloads. A dedicated disclosure channel and response policy will be published before production access.
Build with us
Let’s talk through your requirements.
Bring your security questions, data policies, and team constraints. They belong in the product from the start.
