Trust
Your prompts pass through. They do not stay with us.
Routed API content stays outside 1api's application databases and long-term logs. A limited private cache supports continuation recovery without becoming a customer or administrator archive.
ContentNo application database, long-term log, or customer-accessible content archive.
Gateway API KeyGateway API keys are not stored in plaintext.
Usage metadataUsage metadata remains auditable without raw request or response bodies.
Processing overview
Review Details
A concise view of what is processed to run the service and the boundary that applies to each category.
- Routed API content
- Processing purpose: Fulfil the selected API request and return its response.
- Retention boundary: Not written to application databases or long-term logs; the private continuation cache is the limited exception below.
- Customer Gateway API Key
- Processing purpose: Authenticate and manage the customer credential lifecycle.
- Retention boundary: No plaintext copy; a one-way digest and limited lifecycle metadata remain.
- Usage metadata
- Processing purpose: Meter usage, calculate charges, support auditability, and prevent abuse.
- Retention boundary: Available for about 90-120 days; eligible metadata is archived after day 90 for 2 years.
- Account, billing, and support records
- Processing purpose: Operate the service, resolve disputes, and meet legal obligations.
- Retention boundary: Retained only as needed for the applicable purpose or lawful obligation.
- Upstream processing
- Processing purpose: An upstream AI provider fulfils the selected API request.
- Retention boundary: Controlled by the upstream AI provider under its own terms and data controls.
| Data category | Processing purpose | Retention boundary |
|---|---|---|
| Routed API content | Fulfil the selected API request and return its response. | Not written to application databases or long-term logs; the private continuation cache is the limited exception below. |
| Customer Gateway API Key | Authenticate and manage the customer credential lifecycle. | No plaintext copy; a one-way digest and limited lifecycle metadata remain. |
| Usage metadata | Meter usage, calculate charges, support auditability, and prevent abuse. | Available for about 90-120 days; eligible metadata is archived after day 90 for 2 years. |
| Account, billing, and support records | Operate the service, resolve disputes, and meet legal obligations. | Retained only as needed for the applicable purpose or lawful obligation. |
| Upstream processing | An upstream AI provider fulfils the selected API request. | Controlled by the upstream AI provider under its own terms and data controls. |
Platform boundary
Content handling boundary
Routed API prompts and responses are not written to 1api's application databases or long-term logs. To support response continuation and one bounded recovery attempt, 1api may temporarily retain the minimum required conversation content in an isolated, idle-expiring continuation cache. Each successful cache write starts a rolling one-hour retention period. A successful continuation refreshes that period; cache reads, failed requests, and retries do not. The one-hour period can continue to refresh for an active conversation; there is no separate maximum lifetime. One hour after the last successful cache write, the content becomes unavailable to the Gateway and is scheduled for automatic deletion. The cache is operationally separate from 1api's application databases and long-term logging systems. It is not exposed through customer or administrator consoles, is not a customer-accessible response archive, and is not used for training, analytics, or debugging.
Usage, billing, security, and audit records may retain metadata that does not include prompt or response content. Upstream AI and infrastructure providers process and may retain content under their own terms, retention settings, and data controls.
Privacy resources
Privacy practices for global teams.
GDPR, UK GDPR, and CCPA/CPRA may apply depending on the person, customer, and processing activity. Review the Privacy Policy, Data Processing Addendum, and Subprocessor List for the authoritative public terms.
Customer proof
Trusted by
Reserved placements preserve the layout until approved customer logos are available.
Credential handling
API Key handling
Your API key is shown once — not stored for later.
The full customer Gateway API Key is displayed only when it is created. Afterward, a one-way digest and limited lifecycle metadata are used to verify, rotate, revoke, secure, and audit that credential. The complete key cannot be retrieved later.