Additional Resources
Data and privacy
What the models plane stores about a request, how long it keeps it, and which providers process your prompts.
This page covers the models plane: /v1/chat/completions, /v1/completions and /v1/embeddings on the inference gateway.
What a request row holds
Every models-plane request writes one row to the inference_requests table and one data point to Cloudflare Workers Analytics Engine. The row holds metadata only:
| Column | What it is |
|---|---|
id | The server-generated request id |
api_key_id, org_id | The key that made the call and its organisation |
provider, model | The provider and model that served the request |
model_requested | The model or first candidate you asked for |
route_attempts, route_sort | The routing trail: for each attempt the slug, provider, HTTP status, duration and reason; and the sort you sent |
stream | Whether the response was streamed |
prompt_tokens, completion_tokens, total_tokens | Token counts |
cache_read_tokens, cache_write_tokens, cache_savings_usd | The provider prompt-cache share of the prompt tokens and what it saved |
cost_usd, price_usd, margin_usd | Upstream cost, the price charged, and the difference |
ttft_ms, latency_ms | Time to first token and total latency |
status, error_code | HTTP status and error code |
byok | Whether your own provider key was used |
client_request_id | The x-request-id you sent, if any |
created_at | When the request arrived |
No prompt text and no completion text is stored in the row. The Analytics Engine data point carries the organisation, provider, model, error code, BYOK flag, token counts, cost, latencies and status, and no text either.
Response cache
The exact-match response cache is off by default. An organisation opts in, and only a non-streamed request with an explicit temperature: 0 is eligible. When it is on, the full response body is stored in Cloudflare KV under a SHA-256 hash of your organisation id and the request body. The cache lifetime is the organisation's setting (default 300 seconds), clamped to between 60 seconds and 24 hours. A hit never crosses an organisation boundary.
Retention
- Request rows (
inference_requests) have no scheduled deletion today: they are kept for billing and reconciliation until the account is erased. An account erasure request deletes the organisation's rows. - Cached responses expire with the cache lifetime above, 24 hours at most.
- Sticky-routing pins (a hash of the conversation prefix and the provider that served it, never the text) expire after 300 seconds.
Sub-processors
Your prompt and the completion pass through the upstream provider that serves the request. The gateway can route to the providers below; when you bring your own key (BYOK), your own agreement with that provider applies. The gateway runs in Cloudflare's San Jose region; each provider processes the request in its own infrastructure, under its own terms.
| Provider | Company | Status | Data-use policy | Trains on API traffic? |
|---|---|---|---|---|
openai | OpenAI | Serving | OpenAI enterprise privacy (opens in a new tab) | No, by default (API data is not used for training unless the customer opts in) |
anthropic | Anthropic | Serving | Anthropic commercial terms (opens in a new tab) | No (commercial terms) |
google | Google (Gemini API) | Serving | Gemini API terms (opens in a new tab) | See vendor policy (depends on the billing tier) |
groq | Groq | Serving | Groq privacy policy (opens in a new tab) | See vendor policy |
mistral | Mistral AI | Serving | Mistral AI legal terms (opens in a new tab) | See vendor policy |
deepseek | DeepSeek | Serving | DeepSeek (opens in a new tab) | See vendor policy |
xai | xAI | Serving | xAI privacy policy (opens in a new tab) | See vendor policy |
together | Together AI | Serving | Together AI privacy policy (opens in a new tab) | See vendor policy |
fireworks | Fireworks AI | Serving | Fireworks AI privacy policy (opens in a new tab) | See vendor policy |
cerebras | Cerebras | Serving | Cerebras privacy policy (opens in a new tab) | See vendor policy |
perplexity | Perplexity | Listed in the router, currently not serving (account credits) | Perplexity privacy policy (opens in a new tab) | See vendor policy |
cohere | Cohere | Serving | Cohere privacy policy (opens in a new tab) | See vendor policy |
openrouter | OpenRouter | Serving | OpenRouter privacy policy (opens in a new tab) | See vendor policy (OpenRouter forwards to further providers) |
moonshot | Moonshot AI | Serving | Moonshot AI platform (opens in a new tab) | See vendor policy (endpoint api.moonshot.cn) |
deepinfra | DeepInfra | Serving | DeepInfra privacy policy (opens in a new tab) | See vendor policy |
novita | Novita AI | Listed in the router, currently not serving (no platform key) | Novita AI privacy policy (opens in a new tab) | See vendor policy |
nebius | Nebius | Listed in the router, currently not serving (no platform key) | Nebius privacy policy (opens in a new tab) | See vendor policy |
Cloudflare hosts the gateway, its D1 databases, KV and Analytics Engine.
Data processing agreement
A data processing agreement (DPA) is available on request from PlungeAI support.
SOC 2
PlungeAI is not yet SOC 2 certified, and no SOC 2 audit has been completed. The gateway writes a nightly, hash-chained reconciliation record of the billing ledger against the request rows, kept as evidence for a future audit.
Region
The gateway and every other PlungeAI Worker run placed in one region: San Jose (Cloudflare colo SJC). Upstream providers process requests in their own regions.