No data retention by default

Tokener CA does not keep the content of your requests or of the model's responses. This page explains exactly what that covers, who else handles a request on its way to the model, and what you control.

In short

Tokener never stores your content. The prompts, messages, images, files and tool definitions you send, and the answers, reasoning and tool calls the model returns, are not saved in our database, our logs or any cache — whether you use the API or the Playground.
By default, only suppliers that commit to no retention. Today every model is served by an external model supplier. By default your requests go only to suppliers that commit, in their published terms, to not storing request content and not using it for training.
We tell you before anything else is used. If a model is temporarily available only from suppliers without that commitment, we never send your request there silently: the API answers with an explanation and does not bill you, and the Playground asks you first.
Our own inference is on the way. We are building our own inference service. For models we serve ourselves, no third party is involved, and Tokener enforces the no-retention rule end to end.

What Tokener stores and what it does not

Not stored

Request content: system prompts, messages, images and other attachments, tool definitions and tool results.
Response content: the answer, the reasoning, and tool calls.
Supplier error text: when a request fails, we record our own error code, never the supplier's message, because it can repeat parts of your prompt.

This holds for all three protocols — OpenAI-compatible (Chat Completions), OpenAI Responses and Anthropic-compatible (Messages) — for token counting, and for the Playground. Content exists on our servers only in memory, while your request is being processed.

Stored, for billing and your usage history

For each request we keep a usage record with:

the model, the protocol, and whether the response was streamed;
the token counts (input, cached input, output) and the cost, with the prices used;
the timing (time to first token, total time) and the status, with a coded reason when it failed;
request identifiers, and which supplier served the request;
the API key that was used, or that the request came from the Playground.

These records are what you see on the Usage page. Our server logs hold the same kind of operational data — identifiers, status codes and timing — and never request or response content.

In your browser

The Playground converts attachments (PDFs, documents, images, video frames) in your browser before it sends them. Unsent drafts are kept in your browser tab's session storage and are gone when you close the tab. Nothing from a Playground conversation is saved on our servers.

Who processes your requests

To produce an answer, the content of a request has to reach the machine that runs the model.

Today: external suppliers. Every model is currently served by an external model supplier. We send a request's content to the supplier only so that it can generate the response.
Default: suppliers that commit to no retention. By default your requests go only to suppliers that commit, in their published terms, to not storing request content and not using it for training. We read a supplier's published terms before we route default traffic to it. If your account's setting cannot be read for any reason, the request is routed as if the default were on.
Prompt caching. Our default suppliers state that a recently used prompt prefix may stay in the serving machine's memory for a short time, so that a repeated prompt is faster and cheaper; it is not written to storage. This is what makes the cached-input price possible.
Coming: Tokener's own inference. We are building our own inference service. For models we serve ourselves, no third party is involved, and Tokener enforces the no-retention rule end to end. We will announce it in the Changelog.

Suppliers without that commitment

Some suppliers have not made that commitment. We never use them for your requests without telling you first.

Off by default. Your account uses them only if you turn on Also allow suppliers without that commitment in Settings → Data handling.
What changes when it is on. Those suppliers may store your inputs and may process requests in other countries, under the laws of those countries. In return it can improve availability when a supplier is busy or temporarily unavailable, and you are billed a percentage below the current price on every model — the current discount is shown on Pricing and on the Data handling page. Token counting on the Anthropic-compatible (Messages) protocol is available only while it is on. You can turn it off at any time; the change applies to your next request.
When a model is limited to those suppliers. Sometimes a model is temporarily available only from suppliers without the commitment. If your setting does not allow them, an API request for that model that fails answers 503 model_limited_by_data_handling with a message that says why, and it is not billed (details). In the Playground the model is marked "(limited suppliers)", and selecting it asks whether to use those suppliers for this session (details).

What this page does not cover

Support chat is different. Support conversations are recorded so that we can help you, as the Privacy Policy explains. The support assistant cannot see your API requests.
Your account data — email, sign-in, billing and payments — is handled as described in the Privacy Policy.

Questions

Does Tokener use my prompts to train models?

No. Tokener does not store your prompts or the model's responses, and does not use them for training. By default your requests also go only to suppliers that commit to not using request content for training.

Can Tokener staff read my API requests?

No. The content is not stored, so there is nothing to read afterwards. Support chat conversations are the exception described above.

Is my request encrypted on the way?

Yes, when you use the https:// base URL from the docs. Plain-HTTP requests are redirected to HTTPS, so always configure the https:// address and a request is never sent unencrypted.

Does the Responses API keep my conversation?

No. On Tokener the OpenAI Responses protocol is stateless: you send the whole conversation in input each time, and store: true, previous_response_id, conversation and background: true are rejected (the stateless rules).

How do I check what my account allows?

Open Settings → Data handling. While Also allow suppliers without that commitment is off, your requests go only to suppliers that commit to no retention.

What do your automatic checks send to the models?

Our availability and performance checks send our own fixed test prompt, never customer content, and keep only timing and token counts.