Privacy and data

This page describes what the service does with your data, as implemented. The legal privacy policy and the data processing addendum are separate documents.

What is stored

Data	When	For how long
Call metadata: time, requested and served model, vendor, token counts, cost, routing decision, outcome, latency, key and organization ids	always	call records 24 months; routing decisions 180 days; the billing ledger and audit events for as long as the account exists and for the period the law requires afterwards
Prompts and completions of /v1/chat/completions and /v1/embeddings	only when the API key has body logging on (off by default)	the organization’s retention: 30 days by default, adjustable from 1 to 365
Stored conversations (/v1/responses, /v1/conversations)	when you use them	the organization’s retention, or the shorter or longer retention you set on the conversation; the clock restarts on every turn
A sealed copy of the request of a response created with background: true (the same content the conversation already holds)	while the response is queued or running	until the turn ends, then dropped; deleting the response drops it too
Routing session state: line, the job (task type, difficulty, stakes, subject, language), model, confidence, a few counters and a truncated copy of the last user message	for calls that pass a session id or use a conversation	1 hour after the last call, 24 hours at most
A fingerprint of a long prompt: a keyed hash of its system prompt, tools and messages, never the text, so the prompt is written to the vendor’s cache only when it comes back	prompts of about 1,024 tokens or more that do not ask for caching themselves	until the vendor’s cache would have expired: 5 minutes or 1 hour after the prompt was last seen
Batch files: the input you upload to /v1/files, the results file and the error file of a batch (/v1/batches)	when you use batches	the organization’s retention period, counted from the upload for inputs and from the end of the batch for results, or sooner if you delete them or set an expiry on upload; never while a batch is using them
Your own vendor keys	when you add them	until you remove them
Connected AI apps (MCP): the app’s name, its client id (the address of its metadata document, or the id Zabio gave it when it registered), the host it returns to, the organization and project, what it may do, its daily limit, and when it was connected, last used, expires and was disconnected. Tokens are kept only as a one-way hash	when you connect an app	while the organization, the project and your account exist
Feedback sent with the feedback tool: the call’s id, good or bad, and your reason (500 characters at most)	when an app sends it	while the organization exists
Account data: email, name, language, password hash, sessions, organization memberships, the IP address the account was created from	while the account exists	deleted within 30 days after you delete the account; an account closed for fraud or abuse keeps its records for 2 years and then only a scrambled fingerprint of its email, so the same address cannot sign up again
Server logs: request path, status code, timing, request id and the client IP address; never prompts, completions, keys or passwords. Security events are part of them (sign-up, login, sign-in link and password reset attempts with their outcome, unknown paths, rate-limit refusals, Turnstile failures, welcome credits refused by the abuse caps), read by a CrowdSec engine on our own server that can block an abusive address at Cloudflare on the web app’s auth pages, never on the website or the API	always	30 days

A connected app’s ask calls run on the connection’s API key like any call: metadata as above, never the request or answer text, and the task goes to the vendor that answers.

Prompts and completions are sent to the vendor the call is routed to, under that vendor’s API terms. On auto requests, the routing classifier also receives an excerpt of the request so it can name the job: the first 1,500 characters of your system prompt, the last user message, the names of your tools, the number of attached images, the input size and a short digest of earlier turns; it never receives images, tool results, earlier turns in full or any output. The classifier is TypeSafe AI’s Jev (United States; TypeSafe does not train on API requests) with Anthropic’s Haiku (United States) as the automatic fallback when Jev cannot answer; every response says which one decided in zabio.routing.classifier. The one sentence of reasoning the classifier stores with each routing decision is capped at 200 characters. When you name jev-1.13.0 as the model, TypeSafe AI receives the whole request, system prompt and every message, and returns the answer, like any vendor whose model you name. The same happens when auto answers a classification job with Jev (a request whose JSON schema is made only of fixed choices, booleans and bounded scores, see Classification jobs on auto): the whole request goes to TypeSafe AI, and zabio.model_served says so; naming a text model keeps every request away from TypeSafe except the classifier’s excerpt. When Zabio splits a big auto request (see Split and route), TypeSafe AI also receives the excerpt of your source that the cheap model copied, up to 40 percent of it, so Jev can check that it holds what your question needs; the extractor’s vendor (OpenAI or Google) receives the whole message, as the vendor of a routed call does. Zabio does not use your content to train anything.

Vendor	Where it processes requests
Anthropic, OpenAI, Google, xAI	United States
TypeSafe AI (requests that name jev-1.13.0, and classification jobs auto answers with Jev: the whole request; the routing classifier on auto requests: prompt excerpts only, never full conversations or outputs; on a split auto request, also the excerpt of the source copied for the check)	United States
Together AI (open-weight models and “DeepSeek (North America, via Together AI)”)	North America
Mistral AI	not guaranteed: Mistral AI does not commit to an inference location on its global API
DeepSeek, direct API (“DeepSeek (China)”)	China
Alibaba Cloud (US): the models with ids ending in @alibaba-us, served by Alibaba Cloud Model Studio’s Virginia workspace with the US deployment scope	United States (Virginia): data stored and processed only in the United States. Alibaba Cloud does not use your inputs or outputs to develop or improve its models unless you separately consent (Alibaba Cloud International Website Product Terms of Service, section 4.48, Alibaba Cloud Model Studio). Alibaba’s data retention policy for Model Studio states that prompts and responses are “retained for no longer than 30 days, unless longer retention is required by applicable laws or is reasonably necessary to ensure the security” of the service
Alibaba Cloud (International): the Qwen models with plain ids and the copies with ids ending in @alibaba-intl, served by Alibaba Cloud Model Studio’s Singapore workspace	Data stored in Singapore and processed anywhere outside mainland China. The same terms apply: no use of your inputs or outputs to develop or improve its models without your separate consent, and prompts and responses retained for no longer than 30 days as stated above

Batch files. When you use the batch API, we store the file you upload, the results file and the error file, encrypted, for your organization’s retention period, counted from the upload for inputs and from the end of the batch for results. You can delete a file at any time, or set a shorter expiry when you upload it. We do not keep a copy of batch requests or results outside those files, except the working copies a running batch needs on each line (a result until it is written to the results file, and the shortened request of a line Smart Splitting handled), which are encrypted the same way and deleted when the line ends; and we delete the copies held by the model vendor as soon as we have collected the results. Each line of a batch is sent to the model vendor it is routed to, under that vendor’s API terms, like a normal request.

Every vendor is enabled by default. Owners and admins can turn any vendor off for the organization on the Models page, and the account, a project or an API key can be limited to some models; a vendor that is off never receives your content.

Where

All storage is in the United States. Processing is in the United States too, except for requests routed to Together AI (North America), to DeepSeek’s own API (China), to Mistral AI (no guaranteed region) or to Alibaba Cloud (International) (stored in Singapore, processed anywhere outside mainland China), as listed above; Alibaba Cloud (US) stores and processes only in the United States. No vendor in the catalog processes only in the European Union yet, so an organization that requires EU processing cannot use any model today. Customers anywhere may use the service; content sent from the EU crosses to the US. The transfer basis is described in the data processing addendum.

How stored bodies are protected

• Encrypted with AES-256-GCM under a data key unique to your organization. The data key is wrapped by a master key that lives only in the server’s configuration, with restricted permissions, and can be rotated without re-encrypting your data.
• Each stored item is bound to its own record, so a payload cannot be moved or replayed as another item.
• The web app never displays conversation bodies. They are readable only through the API with a key that has the conversations scope. Logged bodies of stateless calls are readable by owners and admins through an audited endpoint.
• Logs, audit events, metrics and error messages never contain prompts or completions.
• Your own vendor keys are encrypted too, each under its own data key wrapped by the master key; only the last four characters are ever shown.

How data is deleted

• On request. DELETE /v1/conversations/{id} and DELETE /v1/responses/{id} are immediate and permanent. Owners and admins can delete conversations from the web app. Vendor keys are erased when removed.
• By retention. A nightly job removes expired conversations, logged bodies and batch files, routing decisions older than 180 days, and delivered emails older than 30 days.
• Batch files. DELETE /v1/files/{id} is immediate and permanent, except for a file a running batch still needs, which is deleted when the batch ends and you ask again. The vendor’s copies of a batch’s inputs and results are deleted as soon as the results are collected.
• On deleting an organization. An owner deletes it from Settings. Its API keys stop at once; its conversations, logged bodies, files and vendor keys are deleted at once; its members and invitations are removed. Its data key is destroyed 30 days later, after which any remaining ciphertext is unreadable, and everything else about it is deleted at the same point, except the billing records (ledger, payments, the billing details on receipts), which we keep for the period accounting law requires.
• On deleting your account. You delete it from Settings, with your password or right after signing in again, once you no longer own an organization that has other members or a balance; the organizations you own alone are deleted with it. Your account is hidden at once and everything about it is deleted within 30 days (name, email, password, Google identity, tokens, sessions, memberships, the address you signed up from), except billing records and, for an account closed for abuse, the evidence we keep for 2 years.
• Your data, downloaded. Settings has two downloads: your account data (profile, organizations, token and session records, referral names) and, for owners and admins, the organization’s data (members, invitations, projects, key records without the keys, the ledger, the audit log, billing details). Both are JSON files; the usage page exports call records as CSV.

What is never stored

• Payment card numbers. Payments run on Stripe; Zabio keeps your Stripe customer id only.
• API keys in clear. Zabio stores a hash of each key and its first 8 characters.
• Prompts or completions for calls without body logging, outside stored conversations.

Emails

Zabio sends transactional emails only: verification, sign in links, password reset, invitations, payment confirmations and low balance warnings. The text of a sent email is deleted 24 hours after delivery; the record that it was sent (recipient, kind, subject, time) is kept for 30 days for support and then deleted.