Privacy model
Learn how AnonRouter minimizes retained content and separates sensitive roles.
AnonRouter is designed around a narrow promise: route model requests without durably storing prompt or response content. Prompts, responses, keys, and provider payloads are never written to disk. Billing settles from usage metadata only.
What is retained
Operational records may contain:
- Account and credential identifiers
- Provider and model identifiers
- Input, output, and cached token counts
- Estimated and final cost
- Request status and latency
- Request identifiers and timestamps
- Billing, security, and rate-limit metadata
What is not retained
AnonRouter does not intentionally persist:
- Prompt or response text
- System prompts
- Uploaded file contents
- Tool arguments or tool outputs
- Raw provider request or response bodies
- API keys, session cookies, or authorization headers
API keys are stored only as a hash. The plaintext is shown once at creation and never kept.
Hardened production roles
The production architecture separates responsibilities so that no single role holds both your identity and your content:
| Role | Holds | Does not hold |
|---|---|---|
| Control plane | Identity, balance, policy, ticket issuance | Prompt or response content |
| Relay | Request content and opaque ticket redemption | Stable identity and provider credentials |
| Provider worker | Provider credential and authorized provider payload | Customer account identity |
| Compatibility broker | Opt-in key identity and plaintext in memory | Database and provider credential access |
In the private ticket flow, the control plane authenticates your key and mints a ticket, and the relay redeems the opaque ticket and sees content but never your key or account. Neither side can link who sent which prompt.
Compatibility mode is not unlinkable
Compatibility mode removes the ticket step, so the broker must hold your key identity and plaintext request together in memory to mint a ticket internally and forward the request. It logs metadata only and holds no database or provider credentials, but this flow is not unlinkable like the ticket flow. Enable it per key only when a client cannot perform the ticket step.
Upstream providers still process content
No-content logging at AnonRouter does not mean the selected model provider cannot process or retain content. Review the privacy label shown for each route.
Privacy classifications
Every route exposes one privacy classification: anonymous, private, tee, or
e2ee. On Anonymous routes the provider can see the prompt while serving it, so
provider zero-retention is not guaranteed there. Private and stronger routes
carry a no-retention posture. Automatic routing never silently widens the
caller's allowed privacy set. See models and privacy labels for
what each label means.