# Privacy & data

> How INFRO handles customer-connected providers, optional payload logging, plan-based retention, request metadata, and data-protection agreements.

Source: https://infro.io/docs/privacy

> **Note:** INFRO is in private early access. Running these examples requires an early-access account, an active trial or subscription entitlement, and your own provider connection. Self-serve purchasing is not generally open. See [Early access](https://infro.io/early-access).

INFRO processes requests through the AI provider accounts you connect. We do not train on or sell your content. Your providers process it under your own agreements and account settings. The [privacy policy](https://infro.io/privacy) and [DPA](https://infro.io/dpa) describe the full terms.

## Content logging is off by default

Optional prompt and response capture requires organization opt-in and a plan that includes it. Set `logging: false` on an individual request to disable that capture even when the organization has enabled it. Setting `logging: true` cannot override organization policy or plan limits.

```json
{
  "model": "anthropic/claude-sonnet-5",
  "messages": [
    {
      "role": "user",
      "content": "Summarize this release note."
    }
  ],
  "logging": false
}
```

## Retention and access

| Plan | Queryable request history | Optional payload retention |
| --- | --- | --- |
| Developer | 7 days | Up to 24 hours |
| Startup | 14 days | Up to 14 days |
| Team | 30 days | Up to 30 days |
| Business | 90 days | Up to 90 days |

When capture is on, the organization picks a payload window (24 hours, 14, 30, 60 or 90 days, or 1 year); the stored window is the smaller of that choice and the plan's maximum. Expired optional payload logs are deleted. The request-history window describes access through request APIs and exports; it is not a promise to erase all underlying metering records at that date. Usage aggregates and records required for accounting, security or law are retained separately. Enterprise retention follows the agreement.

> **Note:** Logging controls govern optional request captures. Async job state and generated media needed to deliver results are separate. Disabling INFRO logging does not disable storage or logging at your AI provider.

## What providers receive

Each attempted connection receives the input and parameters needed to serve the request, authenticated against your provider account. Retries and fallbacks may send the same input to multiple configured connections. Choose providers, deployments and fallback routes appropriate for your data.

## Response cache

The [response cache](https://infro.io/docs/features/caching) is off by default and a separate opt-in from content logging. When it is on, INFRO stores cacheable responses — the response content, its token counts, the connection that produced it and its estimated provider cost — in Cloudflare Workers KV, per environment, under keys specific to your organization. The prompt is not stored in plaintext; only a hash of the request is kept, as the key. Every entry expires at its TTL (at most 30 days, less on smaller plans), a purge makes entries unreachable at once, and a request sent with `logging: false` is never written to the cache.

## Metadata and credentials

Request records contain model and provider identifiers, connection and route details, usage, latency, status and estimated provider cost. Customer-supplied metadata can itself contain personal data; review it before exporting or sharing. Connected provider credentials are encrypted. Provider cost reconciliation uses a separately connected billing credential.

## Processing locations and agreements

INFRO does not currently offer guaranteed EU-only processing or data residency. Provider locations depend on the accounts and deployments you select. See [EU compliance](https://infro.io/docs/compliance/eu) for the current boundary.

Infrastructure vendors are published at [/subprocessors](https://infro.io/subprocessors). You contract directly with the AI providers you connect. The [DPA](https://infro.io/dpa) is executed by email; there is no console countersigning flow. Contact support for access, export or deletion assistance.