Privacy and retention

Default retention boundary

Usage metadata is retained for billing, security, reconciliation, and service analytics. Prompt and response content is not permanently stored by default when PROMPT_LOGGING_ENABLED is false.

• Usage metadata includes request ID, account/key references, model, skill version, provider route, tokens, cost, latency, status, and timestamps.
• Authorization headers and provider credentials are removed from logs.
• Prompt logging must be a separate, explicit configuration with a stated retention policy.
• Upstream providers still receive the compiled inference request under their applicable data terms.
• OPENROUTER_DATA_COLLECTION=deny filters OpenRouter endpoints marked as data-collecting, but it is not a zero-retention guarantee.
• SkillRouter sends protected developer layers first. Customer developer messages share that role, so proprietary prompts cannot be perfectly secret.

External content

Fetched pages, files, and tool output are untrusted input. They cannot change server-side billing, route policy, model selection, or credential choice unless a documented API field explicitly permits that change.