Data handling
What ModelBeat stores and what it does not, where inference runs, and how to get the DPA and the sub-processor list.
ModelBeat sits in the path of your prompts. That makes what we do and do not keep a design question rather than a policy footnote, so this page states it plainly. The binding version is the Privacy Policy; this page is the engineering summary of it.
Prompts and completions
Prompt and completion content is not retained by default. It is processed to serve your request and it is not stored, not logged, and not used to train anything.
That is enforced at the boundary, not left to discipline: request bodies never reach the log path, and the per-request record described below is metadata only — a fixed set of numbers and identifiers with no room for content in it.
What we do keep, per request
request_id | The X-Request-Id you see on the response. |
| Timestamp | Server-stamped at ingest. |
| Tenant and key id | The verified principal. Never the key itself. |
| Token counts | Prompt and completion. |
| Cost | Priced from tokens, in USD. |
| Latency | Wall-clock milliseconds. |
| Status | Served, errored, rejected, or unsettled. |
| Routing decision | Why the request routed as it did, whether a fallback occurred, and how many attempts it took. |
| Finish reason | How the model stopped — stop, length, tool_calls, content_filter. |
This is what your usage history and your invoices are built from, and it is what an audit enquiry is answered from. See Routing.
What we never store
- Your API key. Keys are stored only as a hash, are shown once at creation, and are never logged. See Authentication.
- Card numbers. Payment details go to Stripe's hosted checkout and never touch ModelBeat systems. We hold no PAN, no CVV, and no card number in any form.
- Prompt or response bodies, per above.
Where it runs
Inference executes on Amazon Bedrock in us-west-2. Your prompt leaves ModelBeat for
the provider that serves it and is subject to that provider's terms for the duration of
the call.
We operate from the United States and India. Where personal data moves between countries we rely on the transfer mechanisms set out in the Privacy Policy.
Retention
| Prompt and completion content | Not retained by default. |
| Per-request metadata | Retained for usage reporting and billing. |
| Billing and ledger records | For as long as financial and tax law requires. The ledger is append-only, so entries are never deleted. |
| Audit log | For the life of the account. Append-only. |
DPA, sub-processors, and deletion
- The Data Processing Agreement and the current sub-processor list are available on request. Ask us — see Support.
- Deletion and access requests are handled under the Privacy Policy. Where a legal obligation requires us to keep something — ledger entries, chiefly — an erasure request cannot reach it, and we will say so.