Core Security Principle: Zero-Training Guarantee
vectorouter strictly guarantees: We never use any customer prompts, completions, context data, embeddings, or file contents transmitted through our API gateway to train, retrain, fine-tune, or improve any foundational AI models, proxy agents, or machine learning algorithms. All payloads stream through working memory in real time without persistent disk storage.
1.Scope & Overview
vectorouter ("we", "us", or "our") provides a high-performance, vendor-neutral API gateway and intelligent routing layer for Large Language Models (LLMs) and generative artificial intelligence systems. We are dedicated to safeguarding the privacy, confidentiality, and sovereignty of data entrusted to us by developers, organizations, and end users.
This Privacy Policy describes our practices regarding the collection, transmission, processing, disclosure, and protection of personal data and system telemetry when you access or interact with:
- Our web application and developer portal located at vectorouter.com (the "Site");
- Our high-concurrency API gateway endpoints, inference proxies, and SDK connectors (the "Service"); and
- Associated developer documentation, customer support channels, and account management tools.
For the purpose of this Policy, "Input" refers to prompt text, code snippets, tokens, multimodal media, or context transmitted by you through our Service. "Output" refers to the responses, streaming tokens, completions, or function calls returned by upstream models.
2.Core Security Principle: Zero-Training Guarantee
The bedrock of our engineering philosophy is that developer and organizational data must remain completely sovereign. vectorouter does not operate proprietary foundational LLMs trained on user interactions.
Our Unconditional Commitments:
- We do not store your Inputs or Outputs for machine learning training.
- We do not sell, license, or barter your request payloads to any AI model vendor, researcher, or broker.
- We default to upstream providers and enterprise routing tiers that support Zero Data Retention (ZDR) wherever available.
- Model responses are streamed directly to your client and purged immediately from gateway working memory.
3.Information We Collect
We adhere strictly to the principle of data minimization. We collect only what is strictly required to reliably route requests, authenticate credentials, enforce rate limits, and audit account token balances:
3.1 Information You Provide Directly
- Account Registration Data: Email address, workspace organization name, and authentication tokens managed securely through our authentication partner (Clerk).
- Billing & Transaction Details: Records of prepaid credit purchases, payment confirmation tokens, and billing addresses. Credit card details are handled directly by PCI-DSS certified payment processors (e.g., Stripe) and are never stored on vectorouter servers.
- Support Communications: Inquiries, bug submissions, or correspondence submitted via email or support channels.
3.2 Technical Telemetry & Metadata Collected Automatically
When your applications invoke our API gateway, we automatically log operational metadata necessary for token metering, routing diagnostics, and DDoS mitigation:
- Token Consumption: Prompt tokens, completion tokens, reasoning tokens, and total billable units.
- Model Routing Identifiers: Targeted model slug (e.g.,
gpt-5.6-sol,claude-opus-4.6) and upstream provider tag. - Performance Latency: Gateway transit time, upstream Time-to-First-Token (TTFT), and total stream duration (ms).
- HTTP Diagnostics: Response status codes (e.g., 200, 429, 502), client IP address, and User-Agent headers utilized exclusively for fraud prevention and rate limiting.
4.Stateless Routing & Data Minimization
vectorouter operates as an in-memory, streaming reverse proxy. Understanding our data lifecycle is straightforward:
In-Flight Request Lifecycle:
- Authentication & Validation: Your client initiates a request with an
Authorization: Bearer vtr-...header. The gateway verifies the hashed key and confirms balance availability in memory. - Protocol Normalization: The request body is adapted to the target provider's schema in runtime RAM.
- Direct Upstream Streaming: The request is dispatched over TLS 1.3 to the selected model provider. Responses are piped directly back to your connection without intermediate hard-disk staging.
- Ephemeral Purge: Once the HTTP stream closes, the payload buffer is destroyed. Only token metrics and latency headers are recorded in the metering ledger.
5.Upstream Model Providers
Our Service routes validated requests to independent third-party Model Providers (including, but not limited to, OpenAI, Anthropic, Google Cloud Vertex AI, DeepSeek, Meta, Mistral, Groq, and xAI).
When you transmit Inputs through vectorouter, those Inputs are forwarded to the provider corresponding to the model you select. Different providers operate distinct data retention policies:
- Zero Data Retention (ZDR) Providers: For enterprise endpoints where ZDR is available and configured, upstream providers agree not to persist prompt payloads beyond the immediate inference window.
- Standard Retention Providers: Certain providers or community-hosted models may retain transient logs for up to 30 days solely for abuse monitoring.
You are responsible for reviewing the data practices and terms of service of each upstream model provider prior to routing sensitive workloads. vectorouter clearly surfaces provider metadata and privacy tags within our Model Catalog.
6.Multimodal & Biometric Processing
Certain models accessible via vectorouter accept multimodal Inputs (including images, audio recordings, video files, or voice samples) and generate multimodal Outputs.
Depending on your jurisdiction (such as Illinois BIPA, Texas CUBI, California CCPA, or EU GDPR), processing audio recordings or facial photographs may implicate biometric identifiers (such as voiceprints or facial geometry):
- Pass-Through Intermediary: vectorouter acts exclusively as an encrypted transit tunnel. We do not independently analyze, extract, catalog, or retain biometric templates from your payloads.
- User Consent Obligation: If you submit audio, images, or video containing depictions or recordings of any individual, you represent and warrant that you have obtained all legally required informed consents and notices prior to transmitting such media through the Service.
8.How We Use Your Data
We process collected data exclusively for legitimate business and technical purposes:
- To fulfill and route inference requests between your client software and chosen AI model engines;
- To meter token usage in real time, debit prepaid credit balances, and generate accurate financial invoices;
- To detect and prevent fraudulent transactions, credential compromise, DDoS attacks, and API abuse;
- To optimize gateway latency, detect regional routing bottlenecks, and ensure 99.9% gateway uptime;
- To transmit critical administrative notices, such as low-balance warnings, API key revocations, or security alerts.
9.Sharing & Third-Party Disclosures
vectorouter does not monetize, sell, or rent your personal data. We disclose information only under the following limited conditions:
- Upstream Inference Providers: Forwarding your prompt inputs and parameters to the respective model provider you have designated in your API request.
- Essential Infrastructure Partners: Cloud hosting infrastructure (e.g., enterprise edge computing networks), authentication services (Clerk), and payment processors (Stripe, Coinbase). These partners are bound by confidentiality and data protection agreements.
- Legal and Regulatory Compliance: We may disclose data if required by a valid subpoena, court order, or governmental regulation, provided we evaluate such demands critically and notify you where legally permitted.
- Business Transfers: In the event of a merger, acquisition, reorganization, or sale of company assets, customer data may be transferred subject to the commitments of this Privacy Policy.
10.Transport & API Key Security
Security is engineered into every tier of the vectorouter routing pipeline:
All communications between your client applications, vectorouter gateway edge clusters, and upstream model providers enforce TLS 1.3 with modern cipher suites to prevent packet sniffing or man-in-the-middle attacks.
All vectorouter API keys (vtr-...) are hashed irreversibly using cryptographically secure algorithms before storage. Keys can never be read or exported once created, and can be instantly revoked from the Console.
11.Your Privacy Rights (GDPR & CCPA/CPRA)
Regardless of your geographical location, vectorouter respects your fundamental rights to control your personal information:
- Right to Access & Portability: You may inspect your registered profile, billing history, and export usage telemetry directly via your account settings.
- Right to Rectification & Deletion: You may update your profile or delete your account at any time. Deleting an account terminates all active API keys and wipes associated personal profiles from active production tables.
- Right to Object & Restrict Processing: You have the right to request restriction of certain processing activities or lodge a complaint with your local supervisory data protection authority.
- California Privacy Rights (CCPA/CPRA): We do not sell or share personal information as defined by the CCPA. We do not discriminate against users who exercise their statutory privacy rights.
To exercise any statutory rights not automated in your developer console, submit a verified request to: support@vectorouter.com.
12.Data Retention, Minors & Contact
12.1 Data Retention Schedule
In-memory payload buffers are discarded immediately upon request completion. Aggregated usage logs, token counts, and ledger accounting entries are retained for a minimum of 24 months for financial auditing, tax compliance, and dispute resolution.
12.2 Protection of Minors
The Service is intended strictly for professional software developers, researchers, and enterprises. We do not knowingly collect or solicit personal data from children under the age of 18 (or the age of majority in your jurisdiction). If we learn that an account belongs to a minor, we will promptly terminate the account and purge any associated records.
12.3 Policy Modifications
We may revise this Privacy Policy periodically to reflect engineering upgrades or regulatory updates. For material changes, we will notify you at least thirty (30) days in advance via email or a conspicuous portal banner. Continued use after the effective date signifies acceptance.
Security & Privacy Governance Contact
For data protection inquiries, Data Processing Addendum (DPA) requests, or security vulnerability disclosures:
Email: support@vectorouter.com
Subject Line: [Privacy & Compliance Inquiry]