Privacy & data handling
What ElevenRouter stores about your requests, for how long, who can see it, and the controls you have. Defaults favour privacy: prompts are not stored unless you turn logging on.
What is recorded per request
Alwaysmetadata- Generation id, timestamps, model and vendor, token counts, exact cost, latency and time-to-first-token, finish reason, status and error code, the key and workspace, optional session/user ids and app attribution, the routing decision and the pipeline summary (variant, preset, transforms, cache, guardrail counts). This is what powers Activity, Logs, billing and the route receipt.
Only when enabledprompts & completions- Request and response bodies are stored only when the organization turns on “Store prompts and completions” (Settings → Privacy & controls). Off by default. When off, nothing you send or receive is persisted after the response is delivered.
Never—- Matched text from guardrail policies (only detector names and counts), your BYOK secrets in plaintext (encrypted at rest, decrypted in memory to sign upstream calls), or card details (handled by the payment processor).
Who sees what
Customers see a model's official vendor (Anthropic, OpenAI, Google…) in the catalog, logs, receipts and headers — never an internal route, credential or infrastructure detail. Error messages, ledger descriptions and generation records are sanitised the same way. Inside an organization, members see logs for the workspaces they belong to; owners and admins see everything; the platform operator sees metadata for support and abuse prevention and, when you enabled prompt logging, the stored bodies.
Retention
Generation metadata13 months- Kept for billing reconciliation, analytics and exports. Aggregated daily rollups are kept indefinitely without identifiers.
Stored prompts/completions30 days- When logging is on. Turning logging off stops new storage immediately; existing bodies age out or can be purged on request.
Response cache≤ 7 days- Cached answers are scoped to one API key, live in memory for the TTL you set (max 7 days) and are dropped when the key is deleted or the organization disables the cache.
Audit log24 months- Who changed what (keys, budgets, policies, members) with IP and request id.
Policy events90 days- Which rule fired on which request; never the matched text.
Controls you have
Prompt loggingorganization- Off by default; toggle in Settings → Privacy & controls.
Vendor allow/block listsorganization- Keep traffic away from vendors you have not approved; the eligibility preview shows the effect per key.
Sensitive-information redactionpolicy- Strip emails, phone numbers, cards, IPs, secrets, IBANs, SSNs and custom patterns from prompts before they leave ElevenRouter, and from non-streamed answers.
Key lifetimeorganization- Force keys to expire within N days.
Response cacheorganization / request- Opt in per request with X-ER-Cache; disable account-wide.
Data exportorganization- Export generation metadata as CSV or JSON from Logs, or through the analytics API.
Deletionrequest- Deleting a key removes its cached responses immediately. Deleting an organization removes keys, budgets, policies, presets and stored bodies; billing records are retained as required by law. Contact support for account-wide erasure requests.
Vendor data handling
Prompts are sent to the model's vendor to produce the answer; each vendor's own retention and training policies apply to that processing. Use the vendor controls above to restrict which vendors may receive your traffic, and provider.require_parameters or model allow-lists to pin specific models. ElevenRouter does not use your prompts or completions to train models.
Security
API keys are stored as SHA-256 hashes and shown once. BYOK secrets are encrypted with AES-256-GCM using a key held outside the database. All traffic is TLS. Management keys are rate-limited and every control-plane action is audit-logged. Report vulnerabilities to security@elevenrouter.com.