Security & data
What we keep, and what we don't
Gatewayz sits between your code and the model providers. This page states exactly what that position lets us see and what we keep, in the same terms our retention jobs are written in.
Your prompts and completions
The API does not store prompt or response content. Requests to /v1/chat/completions, /v1/messages and the other inference endpoints are forwarded to the provider serving the model you chose, and the response is streamed back. What we record is billing metadata: which key, which model, how many tokens, what it cost.
The provider serving your request processes its content under that provider's own terms and data policy.
The exception is the Gatewayz chat app: conversations you have there are kept as chat history so you can return to them. Calling the API directly creates no history.
Retention
| Data | Kept for | Notes |
|---|---|---|
| Request metadata (model, token counts, cost) | 90 days | Then rolled up into daily per-model totals with no request detail. |
| Usage records and account activity log | 400 days | Kept over a year to cover payment disputes. |
| Credit ledger (top-ups and deductions) | Kept | The financial audit record. Holds amounts and reason codes, never request content. |
| Payment webhook events from Stripe | 90 days | Payment notifications, not inference data. |
| Error reports | 90 days | Sent without email addresses, IP addresses or request and response bodies. |
Deletion runs on a daily schedule.
API keys
The dashboard shows only the last four characters of a key after it's created. A request that supplies an invalid key is rejected rather than treated as anonymous, and each key can carry its own request cap.
Transport and payments
The API accepts TLS 1.3 connections. Payments are processed by Stripe; card details go to Stripe and never reach our servers.
Reporting a vulnerability
Email support@gatewayz.ai with "Security" in the subject. Please give us a reasonable window to fix an issue before disclosing it. The same contact is published at /.well-known/security.txt.
In plain language
A walkthrough for non-specialists: how Gatewayz keeps you secure.
Procurement
For security questionnaires, data-processing terms or anything this page doesn't answer, contact sales@gatewayz.ai.