Security
Router One is a proxy in the request path. This page documents exactly what we capture, what we never store, and how the data flows — so security review never has to depend on a sales pitch.
Last updated:
What we do NOT store
- Request bodies
- Prompt content and message history are not persisted. They pass through in real time.
- Response bodies
- Model completions are not persisted. Streaming responses are forwarded byte-for-byte.
What we DO log
- Per-request metadata
- Timestamp, account and API key identifiers, final model and provider, input / output / cache token counts, latency, status code, and computed cost.
- Why
- This metadata powers the per-request trace, billing reconciliation, and internal route selection that make the gateway useful — there is no observability without it.
Transport & key handling
- TLS
- All inbound and outbound traffic is over TLS 1.2+. Plain HTTP is never served: the edge answers it with a redirect to HTTPS. Call the https:// endpoint directly — anything sent over plain HTTP has already left your machine in cleartext before the redirect arrives.
- API keys
- Customer keys are stored hashed at rest. They are never returned by any API endpoint after the create-key call.
- Upstream credentials
- Per-provider keys are platform-owned and rotated regularly. Customers never see upstream credentials.
Upstream behavior
- We pass through
- Once a request leaves Router One, the upstream provider's data policies apply on their end. We do not control their retention.
- Provider selection
- A specified model can use another healthy provider route for that model; model:auto can use server-configured candidates. The final model and provider are recorded in the per-request trace.
FAQ
Does Router One train on my prompts or completions?
No. Request and response bodies are not retained. We have no training data pipeline.
Can I export the metadata Router One has on my account?
Yes — the dashboard exposes per-request trace and aggregated metrics. Enterprise contracts can include programmatic export.
How long is metadata kept?
90 days for observability and 13 months for billing reconciliation, then purged. Enterprise contracts can adjust this window.