Key facts
| Training on customer data | No — prompts are not used to train models |
| Processing purpose | Prompts and outputs are processed to fulfil requests |
| Retention controls | Configurable; logs can be limited in private deployments |
| Enterprise options | Zero-retention and private deployment paths |
| Sub-processors | Disclosed in the DPA and legal terms |
| Self-serve logging | Standard operational logs for abuse prevention may apply |
| Encryption | In transit, and managed or BYOK at rest |
| Product status | Live |
TL;DR
- Your prompts are not training data — that is a policy commitment, not a default.
- Requests are processed to answer them; retention is a separate, documented control.
- Self-serve keeps operational logs for abuse prevention under standard terms.
- Private deployments can restrict logging far more tightly.
- For contractual certainty, get the DPA and retention terms in writing.
How it works, step by step
- Classify the data in your prompts: public, internal, personal, regulated.
- Read the privacy documentation and DPA for retention and sub-processor terms.
- Decide whether self-serve logging terms are acceptable for each workload.
- Move sensitive workloads to a private deployment where logging can be restricted.
- Redact unnecessary personal data before it reaches any API, as a defence in depth.
- Record the data-flow in your own privacy assessment and vendor register.
Try it yourself
Open the AI API key security checklist →
Processing, retention and training are three different things
Most confusion comes from treating these as one question.
- Processing: your prompt must be handled by compute to produce a completion. That is inherent to any hosted API.
- Retention: how long prompts, outputs or logs are stored afterwards. This is a policy and configuration question, and it is where private deployments change the answer.
- Training: whether your content is used to improve models. Plugsky does not train models on your prompts or pass your data to third parties for training.
Ask vendors to answer all three separately; a vague 'we do not train on your data' does not tell you what is retained or for how long.
How retention controls differ by deployment
On the shared self-serve cloud, standard operational logs support abuse prevention, debugging and capacity planning under the published terms. In a VPC, on-prem or air-gapped deployment, logging and storage live in your environment and can be configured to your policy — including minimal or zero application-log retention if your requirements demand it. Encryption applies in transit everywhere, and at rest with Plugsky-managed keys on shared cloud or your own KMS/HSM in private deployments. The practical advice: match the deployment to the sensitivity of the data, not the other way around.
What we do and what we do not do
What we do: document processing and retention in the privacy terms and DPA, disclose sub-processors, offer private deployments that remove provider-side storage, and support BYOK. What we do not do: claim zero retention on plans where standard operational logs exist, or hide retention behind a marketing line — the specifics live in the terms and your agreement. For regulated data, get the DPA reviewed by legal before the first prompt, and keep redaction in your own pipeline as a second layer.
Honest comparison
| Question | Plugsky shared cloud | Plugsky private deployment | Typical hosted API |
|---|---|---|---|
| Used for training? | No | No | Varies — check terms |
| Request retention | Standard operational logs under terms | Configurable to your policy | Provider-defined |
| Zero-retention option | Via enterprise agreement | Yes, in your environment | Sometimes, enterprise tier |
| Sub-processor visibility | Listed in DPA | Minimal, you approve | Provider list |
| Encryption keys | Plugsky-managed | Your KMS or HSM | Provider-managed |
| Best fit | Most product workloads | Personal and regulated data | Non-sensitive workloads |
Frequently asked questions
Do you train on my prompts?
No. Plugsky does not train models on your prompts or share your data with third parties for training. The models you call are pre-trained.
How long are prompts stored?
Retention depends on deployment and plan. Self-serve keeps standard operational logs under the published terms; private deployments can restrict retention to your policy.
Can I get zero retention?
Yes, in a private deployment or under an enterprise agreement where application logging is minimised or removed. Confirm the exact configuration in writing.
Is my data shared with model providers?
Plugsky serves models through its own platform. Where external routing is used, sub-processors are disclosed in the DPA.
What about embeddings I send?
Embedding inputs are processed the same way prompts are: used to return vectors, not for training, with retention governed by deployment and terms.
How do I evaluate this for compliance?
Read the privacy documentation and DPA, map your data flows, and choose the deployment that matches the classification of the data you send. The free plan is fine for non-sensitive prototyping.
Can I use the free plan for confidential data?
The free plan runs on the shared cloud under standard terms. For confidential or regulated data, prototype with redacted samples and move production to a private deployment.