1. Short version
- Open Token does not persist API prompts or model responses in its application database.
- Prompt and response content is not used by Open Token to train or improve AI models.
- Requests are transmitted to the model provider of the connection Customer chooses (Amazon Bedrock, OpenAI, Anthropic, Google Gemini, Vertex AI, Azure OpenAI, Mistral, Cohere, or an OpenAI-compatible endpoint); upstream handling depends on that provider, Customer's account with it, and applicable model terms.
- Open Token stores request metadata needed for billing, usage reports, reliability, security, and support.
- The production application's operational logs are configured to expire after fourteen days.
2. What the application stores
| Data | Current storage behavior | Why it is used |
|---|---|---|
| Prompt and response content | Held in application memory while serving the request; not inserted into Open Token's database and not intentionally written to application logs. | Route the request and return the model response. |
| Generation metadata | Generation ID, company ID, API-key ID, model, provider, BYOK flag, streaming flag, input and output token counts, customer cost, provider cost, latency, status, finish reason, and timestamp. | Metering, account reporting, ledger reconciliation, reliability, and support. |
| Failed-request description | A provider or application error message, truncated to 500 characters, is stored with generation metadata. | Troubleshooting failed requests. Customers should avoid secrets in request fields that providers may echo in errors. |
| API keys | Name, visible prefix, one-way hash, status, optional spending limit, usage, and timestamps. The full key is shown once and is not stored. | Authenticate calls, display key inventory, and enforce limits. |
| BYOK credentials | Provider API keys and any AWS access-key material are encrypted at rest with AES-256-GCM. A masked hint, label, region, status, and timestamp are also stored. An AWS role connection stores no secret. | Authenticate requests to the provider of Customer's connection, under Customer's account with that provider. |
| Account and acceptance records | User and company profile, password hash, role, company country, status, last login, and accepted Terms version and timestamp. | Authentication, administration, regional model controls, and agreement records. |
| Credits and billing | Balance, ledger entries, Stripe customer and checkout IDs, purchase amount, fees, status, creator, and payment timestamps. | Fund the account, charge usage, issue billing documents, and process refunds. |
| Contact requests | Name, company, email, message, user agent, delivery status, limited delivery error, and a keyed hash of the sender IP. | Respond to inquiries, deliver support email, and rate-limit abuse. |
3. Request path
- Open Token authenticates the API key and loads the company, model, and account configuration.
- Open Token selects the connection that serves the call: the one Customer placed closest to the API key (environment, project, team, or company).
- The request body is validated and transformed into that provider's request format.
- Input content and technical metadata are sent to that provider only. Open Token never switches a call to a different provider or connection Customer did not choose. Where the provider supports it, Open Token includes internal organization, key, and generation identifiers in provider request metadata.
- The response is returned to Customer, streamed when requested, and metering data is recorded.
- Content variables are released after request processing; they are not written to the application database.
4. Platform keys and BYOK
With a platform key, Open Token invokes Amazon Bedrock using Open Token's AWS account. With BYOK, Open Token assumes Customer's AWS role, or decrypts Customer's stored key in application memory, and uses it to send the request to the provider of Customer's connection under Customer's account with that provider. Open Token still processes the request and retains the same usage and billing metadata in either mode.
BYOK can change provider-side region, retention, logging, contractual, and billing behavior because Customer's account settings and agreement with that provider apply. Customer should use dedicated, least-privilege credentials and disconnect credentials that are no longer needed.
5. Provider handling
Model providers are separate recipients involved in inference. Their handling can differ by provider, model, feature, region, and account configuration. Open Token does not promise that every provider offers zero data retention. Before transmitting confidential, regulated, or personal data, Customer must evaluate the current Amazon Bedrock security and privacy information, the equivalent information of the provider Customer connects, and the terms on our model page.
Inference content goes only to the recipient of the connection Customer chooses:
- Amazon Bedrock: Amazon Web Services, in Customer's AWS account.
- OpenAI: OpenAI, under Customer's OpenAI account.
- Anthropic: Anthropic, under Customer's Anthropic account.
- Google Gemini: Google, through the Gemini API under Customer's key.
- Vertex AI: Google Cloud, in Customer's Google Cloud project.
- Azure OpenAI: Microsoft Azure, in Customer's Azure resource.
- Mistral: Mistral AI, under Customer's Mistral account.
- Cohere: Cohere, under Customer's Cohere account.
- OpenAI-compatible endpoint: the operator of the endpoint Customer configures.
6. Operational logs
The production application sends standard runtime messages and application errors to Amazon CloudWatch. The infrastructure configuration retains that log group for fourteen days. Open Token does not intentionally log prompt or response bodies. Diagnostic exceptions can contain provider-generated details, so customers should not place credentials or unnecessary sensitive information in Inputs or optional request fields.
Amazon CloudFront and other infrastructure services may process ordinary network and request information to deliver and protect the service under AWS's terms. Open Token's contact rate limiter stores a keyed, truncated hash rather than the contact sender's raw IP address in the application database.
7. Retention and deletion
Generation metadata, account records, and billing records currently remain in the database while needed to operate the account and afterward for accounting, security, disputes, and legal compliance. There is no customer-facing control to delete individual generation metadata. Staff can remove a stored BYOK credential when Customer disconnects it. Prompt and response content has no Open Token database retention period because the application does not persist it.
To request account data deletion or a retention review, email support@getopentoken.com. We will apply contractual commitments, applicable law, and legitimate recordkeeping exceptions. Provider-side deletion requests may need to be directed to the provider or handled through Customer's own account with it.
8. No model training by Open Token
Open Token does not use Customer Inputs or Outputs to train, fine-tune, or evaluate AI models. We may use aggregate, non-content usage statistics to operate, secure, forecast, and improve the platform. This promise does not alter the independent terms of AWS or a third-party model provider.
9. Changes
This policy describes the application as currently implemented. If we add optional content logging, prompt storage, caching, new inference providers, or training uses, we will update this page and provide appropriate notice or choice before applying that change to existing Customer content.