# Security

> Markdown mirror of https://router.one/security for AI assistants and crawlers. Router One is an OpenAI-compatible LLM API gateway.
> Last updated: 2026-08-24

Router One is a proxy in the request path. This page documents exactly what we capture, what we never store, and how the data flows — so security review never has to depend on a sales pitch.

## What we do NOT store

### Request bodies

Prompt content and message history are not persisted. They pass through in real time.

### Response bodies

Model completions are not persisted. Streaming responses are forwarded byte-for-byte.

## What we DO log

### Per-request metadata

Timestamp, account and API key identifiers, final model and provider, input / output / cache token counts, latency, status code, and computed cost.

### Why

This metadata powers the per-request trace, billing reconciliation, and internal route selection that make the gateway useful — there is no observability without it.

## Transport & key handling

### TLS

All inbound and outbound traffic is over TLS 1.2+. Plain HTTP is never served: the edge answers it with a redirect to HTTPS. Call the https:// endpoint directly — anything sent over plain HTTP has already left your machine in cleartext before the redirect arrives.

### API keys

Customer keys are stored hashed at rest. They are never returned by any API endpoint after the create-key call.

### Upstream credentials

Per-provider keys are platform-owned and rotated regularly. Customers never see upstream credentials.

## Upstream behavior

### We pass through

Once a request leaves Router One, the upstream provider's data policies apply on their end. We do not control their retention.

### Provider selection

A specified model can use another healthy provider route for that model; model:auto can use server-configured candidates. The final model and provider are recorded in the per-request trace.

## FAQ

### Does Router One train on my prompts or completions?

No. Request and response bodies are not retained. We have no training data pipeline.

### Can I export the metadata Router One has on my account?

Yes — the dashboard exposes per-request trace and aggregated metrics. Enterprise contracts can include programmatic export.

### How long is metadata kept?

90 days for observability and 13 months for billing reconciliation, then purged. Enterprise contracts can adjust this window.

## See also

- Methodology: https://router.one/methodology
- Data retention: https://router.one/data-retention
- Availability & SLA: https://router.one/sla
- Trust hub: https://router.one/trust
- Canonical page: https://router.one/security
- Models and per-model token rates: https://router.one/models (markdown: https://router.one/models.md)
- Pricing: https://router.one/pricing
- API docs (markdown): https://router.one/docs.md
- Company facts: https://router.one/facts/company.md