Security and data handling

Request and response content from shared endpoints is kept in a private, encrypted request log for up to 30 days, for debugging. Recognized API keys and credentials are removed before it is stored.

Dedicated endpoints and private installations are never request-logged. Any organization can opt out of request logging, or turn on HIPAA mode, which also turns it off.

Billing, analytics and process logs never hold prompt or response content. They keep metadata only, such as model, token counts, cost and status.

Error messages never echo your input or a provider's raw error.

RouterPlus API keys are checked by SHA-256 hash.

Provider credentials you connect with bring your own key are envelope-encrypted and never returned by any API or page. A Bedrock connection stores a role ARN, never AWS keys.

RouterPlus stores no passwords. Sign-in, passwords and Google sign-in are handled by Clerk.

Google sign-in asks only for basic identity (email and profile), never Gmail, Drive or Calendar.

Each model provider keeps data under its own policy. The data policy lists what each one does.

See each provider in the data policy

Organizations can set guardrails on models, providers, data and budget, per organization or per API key.

Guardrails docs