Also
Legal
Data retention
Public, unauthenticated. Prompts are sealed and not logged; this page is honest about where plaintext still exists.
Last updated: 3 September 2026.
This is the retention schedule for the hosted NeuronPool coordinator. It is the Zero Data Retention (ZDR) statement for prompt and completion bodies at the coordinator, plus the metadata we do keep. Related: Privacy, Terms.
Prompt and completion bodies (ZDR)
- Not logged. Coordinator logs, audit events, and SIEM export strip prompt/response fields.
- Sealed at rest for sealed hosts. When the serving host has published a seal key (every current agent does), sealed envelopes (X25519 + XChaCha20-Poly1305) are what D1
request_json/result_jsonand the Durable Object persist. Logprobs blobs in R2 are wrapped the same way. A legacy or third-party host that registers without a seal key is served unsealed, so that job's request and result sit in D1 in plaintext until the purge below removes them. - Not used for training. There is no training job and no prompt archive for model improvement.
- Transient plaintext exists only in the buyer Worker isolate (to write the HTTP response) and in the serving host process (to run the model). Those copies are not coordinator retention.
This is ZDR at the coordinator. It is not ZDR at the host. Hosts at none / software (Linux, Windows, and macOS today) can see plaintext. The OpenRouter zdr flag on /openrouter/models stays false by default because we do not grant a hardware tier and will not advertise host-side zero retention we cannot keep.
What we retain, and for how long
| Record | Retention | Why |
|---|---|---|
| Prompt / completion plaintext | Not retained for sealed hosts; request/result bodies of any job are erased after 7 days | Sealed path; coding rule; audit denylist; daily purge |
| Job metadata (id, model, tokens, timestamps, status, host pseudonym, trust, pool) | 30 days | Usage, routing, public stats, verification sampling |
| Ledger rows, invoices, Stripe / USDC payment references | 7 years | Tax and accounting. Rows are anonymised, not deleted, if an account is later removed. |
| Coordinator / Cloudflare observability logs | 7 days | Operations. Must not contain prompt bodies. |
audit_log | Life of the org (and after, until a deletion path exists) | Security mutations; hash-chained; no prompt fields |
| Account, keys (hashes), hosts, pool membership | Until the account is deleted or the row is replaced | Running the service |
| Blessed-build registry, public stats aggregates | Product life | Trust and marketplace |
Job metadata older than 30 days is out of the product window used by /v1/usage (default 30 days) and the public SLO / stats pages. The minute cron runs a purge once a day: it erases request_json / result_json on finished jobs older than 7 days and deletes finished job rows older than 30 days (with their verification sampling rows). Ledger rows keep only the job id.
Hosts and buyers
We do not control what a host writes to its own disk. Public hosts are required by the Terms not to retain buyer prompts; that is a contractual rule, not a TEE.
Buyers who need the serving CPU under their own processor terms must stay on a tenant pool (strict_pool) and not send that traffic public.
Self-host
If you run the coordinator yourself, this schedule is a template. Your Cloudflare account, backups, and log drains are yours to configure.