Privacy & zero data retention¶
Keln makes two separate promises about your content. They're independent guarantees, evaluate each on its own:
- Zero data retention, prompt and completion content is never stored anywhere.
- Zero training, nothing you send is used to train or improve a model, by anyone in the serving path.
1 · Never stored¶
Request and response bytes stream through memory on the edge and the serving route and are gone when the stream ends.
| Stored? | What exists instead | |
|---|---|---|
| Prompts | Never | token counts |
| Completions | Never | token counts |
| Request metadata | Yes | timestamp, model, token counts, cost, latency, status, which of your API keys |
| Logs | Content-free | operational events only, no payload bytes in any log line |
Your usage dashboard shows model, tokens, cost, and latency per request, and that is everything that is stored.
2 · Never trained on¶
Your content is used for exactly one thing: generating your response. It is not used to train, fine-tune, or improve any model or service, not by Keln, and not by anyone serving your request. There is no opt-in that changes this.
Coming from OpenRouter?
provider: {"zdr": true} and provider: {"data_collection": "deny"} are accepted and
satisfied by construction, on Keln they describe every request, so there is nothing to
opt into and no reduced pool to route within. You can delete the flags.
The supply standard¶
Keln routes across a serving pool, so both promises have to hold at every route:
- Contractual. Zero retention and no-training are requirements of Keln's supply agreements.
- Verified. Before onboarding, Keln checks each provider's binding terms against both promises and tracks any gap to closure.
- Nothing to retain at Keln. Keln retains no content, and requests leave Keln carrying no user identity: no account id, no API key, no IP.
- Re-serialized. What goes upstream is Keln's own re-serialization of your request, so stripped fields cannot leak by pass-through.
- Known counterparties. Providers are identified businesses under contract.
- Web search is the one exception, and only when you ask for it. A request that opts into web search sends its search queries, never your messages, to a third-party search engine. Results are relayed, not stored, and the logs keep the query length and the result count, not the text.
Injected provider system prompts are detected and removed, so the model sees your messages only.
Compliance posture¶
There is no stored-content system to audit. Metadata (counts, timings, billing) is retained for billing and abuse prevention. DPAs and regional commitments: contact us.