Trust

Where a request goes

1. Your client sends the request to api.veil.ir over TLS.
2. Veil checks your key, your limits and your privacy floor, and picks a provider that meets them.
3. The request goes to that provider; the answer streams back to you as it arrives.
4. Veil records the request's metadata and cost. The prompt and the answer exist only in memory and are gone when the request ends.

What Veil keeps

For every request, Veil keeps this metadata and nothing else:

• when it happened
• your organization and the key used
• the key's settings at the time (its cap, limits and allowed models)
• the model asked for and the route that served it
• the provider
• the formats spoken in and out
• whether it streamed
• the status and outcome
• token counts
• the cost, line by line, with the price card version
• each provider attempt with its status and timing
• time to first token and total time
• the app name, referrer and session id your client chose to send

This metadata has no expiry today: it's the record of what you were charged. A retention period will be published here before launch.

What Veil never keeps

The prompt, the files and the answer are never written to the database, logs, queues, metrics or error reports.

The first exception is yours to turn on: body logging per key, off by default, with a retention you choose of 1 to 30 days. Logged bodies are encrypted with a key per organization, marked on every request, and deleted at expiry.

The second is a batch, if you send one: it runs after your request returns, so its requests and results are kept, encrypted with your organization's key, until an hour after you download the results, or 72 hours after the batch ends if you never do. Requests sent one by one are never kept.

Your privacy floor

In the console you can refuse every provider that trains on prompts, or keep only those that keep nothing. A provider whose policy is unknown counts as one that does. If no provider meets your floor, the request fails with an error naming the setting; it never quietly goes elsewhere.

Who receives your prompts

These providers serve Veil API routes today, with their regions:

Each model page shows its routes and what each one keeps

How the rule is enforced

A build rule fails Veil's build if any code in the gateway could write a prompt or an answer to a log, and the gateway logs from a fixed list of fields. The rule isn't a promise in a policy; it's a check that runs on every change.