> ## Documentation Index
> Fetch the complete documentation index at: https://docs.plungeai.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Data and privacy

> What the models plane stores about a request, how long it keeps it, and which providers process your prompts.


This page covers the models plane: `/v1/chat/completions`, `/v1/completions` and `/v1/embeddings` on the inference gateway.

## What a request row holds

Every models-plane request writes one row to the `inference_requests` table and one data point to Cloudflare Workers Analytics Engine. The row holds metadata only:

| Column | What it is |
|---|---|
| `id` | The server-generated request id |
| `api_key_id`, `org_id` | The key that made the call and its organisation |
| `provider`, `model` | The provider and model that served the request |
| `model_requested` | The model or first candidate you asked for |
| `route_attempts`, `route_sort` | The routing trail: for each attempt the slug, provider, HTTP status, duration and reason; and the `sort` you sent |
| `stream` | Whether the response was streamed |
| `prompt_tokens`, `completion_tokens`, `total_tokens` | Token counts |
| `cache_read_tokens`, `cache_write_tokens`, `cache_savings_usd` | The provider prompt-cache share of the prompt tokens and what it saved |
| `cost_usd`, `price_usd`, `margin_usd` | Upstream cost, the price charged, and the difference |
| `ttft_ms`, `latency_ms` | Time to first token and total latency |
| `status`, `error_code` | HTTP status and error code |
| `byok` | Whether your own provider key was used |
| `client_request_id` | The `x-request-id` you sent, if any |
| `created_at` | When the request arrived |

No prompt text and no completion text is stored in the row. The Analytics Engine data point carries the organisation, provider, model, error code, BYOK flag, token counts, cost, latencies and status, and no text either.

## Response cache

The exact-match response cache is off by default. An organisation opts in, and only a non-streamed request with an explicit `temperature: 0` is eligible. When it is on, the full response body is stored in Cloudflare KV under a SHA-256 hash of your organisation id and the request body. The cache lifetime is the organisation's setting (default 300 seconds), clamped to between 60 seconds and 24 hours. A hit never crosses an organisation boundary.

## Retention

- Request rows (`inference_requests`) have no scheduled deletion today: they are kept for billing and reconciliation until the account is erased. An account erasure request deletes the organisation's rows.
- Cached responses expire with the cache lifetime above, 24 hours at most.
- Sticky-routing pins (a hash of the conversation prefix and the provider that served it, never the text) expire after 300 seconds.

## Sub-processors

Your prompt and the completion pass through the upstream provider that serves the request. The gateway can route to the providers below; when you bring your own key (BYOK), your own agreement with that provider applies. The gateway runs in Cloudflare's San Jose region; each provider processes the request in its own infrastructure, under its own terms.

| Provider | Company | Status | Data-use policy | Trains on API traffic? |
|---|---|---|---|---|
| `openai` | OpenAI | Serving | [OpenAI enterprise privacy](https://openai.com/enterprise-privacy/) | No, by default (API data is not used for training unless the customer opts in) |
| `anthropic` | Anthropic | Serving | [Anthropic commercial terms](https://www.anthropic.com/legal/commercial-terms) | No (commercial terms) |
| `google` | Google (Gemini API) | Serving | [Gemini API terms](https://ai.google.dev/gemini-api/terms) | See vendor policy (depends on the billing tier) |
| `groq` | Groq | Serving | [Groq privacy policy](https://groq.com/privacy-policy/) | See vendor policy |
| `mistral` | Mistral AI | Serving | [Mistral AI legal terms](https://mistral.ai/terms) | See vendor policy |
| `deepseek` | DeepSeek | Serving | [DeepSeek](https://www.deepseek.com/) | See vendor policy |
| `xai` | xAI | Serving | [xAI privacy policy](https://x.ai/legal/privacy-policy) | See vendor policy |
| `together` | Together AI | Serving | [Together AI privacy policy](https://www.together.ai/privacy) | See vendor policy |
| `fireworks` | Fireworks AI | Serving | [Fireworks AI privacy policy](https://fireworks.ai/privacy-policy) | See vendor policy |
| `cerebras` | Cerebras | Serving | [Cerebras privacy policy](https://www.cerebras.ai/privacy-policy) | See vendor policy |
| `perplexity` | Perplexity | Listed in the router, currently not serving (account credits) | [Perplexity privacy policy](https://www.perplexity.ai/hub/legal/privacy-policy) | See vendor policy |
| `cohere` | Cohere | Serving | [Cohere privacy policy](https://cohere.com/privacy) | See vendor policy |
| `openrouter` | OpenRouter | Serving | [OpenRouter privacy policy](https://openrouter.ai/privacy) | See vendor policy (OpenRouter forwards to further providers) |
| `moonshot` | Moonshot AI | Serving | [Moonshot AI platform](https://platform.moonshot.cn/) | See vendor policy (endpoint `api.moonshot.cn`) |
| `deepinfra` | DeepInfra | Serving | [DeepInfra privacy policy](https://deepinfra.com/privacy) | See vendor policy |
| `novita` | Novita AI | Listed in the router, currently not serving (no platform key) | [Novita AI privacy policy](https://novita.ai/legal/privacy-policy) | See vendor policy |
| `nebius` | Nebius | Listed in the router, currently not serving (no platform key) | [Nebius privacy policy](https://nebius.com/privacy-policy) | See vendor policy |

Cloudflare hosts the gateway, its D1 databases, KV and Analytics Engine.

## Data processing agreement

A data processing agreement (DPA) is available on request from PlungeAI support.

## SOC 2

PlungeAI is not yet SOC 2 certified, and no SOC 2 audit has been completed. The gateway writes a nightly, hash-chained reconciliation record of the billing ledger against the request rows, kept as evidence for a future audit.

## Region

The gateway and every other PlungeAI Worker run placed in one region: San Jose (Cloudflare colo SJC). Upstream providers process requests in their own regions.