Security & Data Protection

1. We do not store your content

Our database records billing metadata only (the model routed to, token counts, latency, timestamp). Per-request cost is not stored — billing figures are derived from those token counts. There is no column anywhere that stores prompt or response content. Request bodies are never written to server logs, and your messages are released from memory once the response is returned — nothing is persisted.

2. Never used for training

Your content is used solely to generate the response you asked for. TokenTable never uses it to train or fine-tune any model, and never shares it as training data with third parties.

3. Confidential mode (content reaches only the serving model)

By default TokenTable may quality-sample a small fraction of traffic, or summarise very long conversations with an in-house model — neither is persisted, but both briefly route content to a model other than the one answering you. Confidential mode disables both paths, so your content reaches only the single model serving the request. Enable it as an account default, or per request with the header X-TT-Confidential: true.

4. Where your data is processed

Chinese/Asian providers run on the Hong Kong node; Western providers (OpenAI/Anthropic/Google) are reached via the Singapore egress. Every response carries an X-TT-Processed-Region header (HK or SG) telling you exactly where that request was handled.

5. Encryption in transit & keys

All connections use TLS 1.2+. API keys are hash-matched and revocable, each bound to a single account with a per-minute request limit. Upstream provider keys live only on the server and are never sent to clients or written to any log.

6. Account isolation & access control

Each account’s usage, quota and keys are isolated and strictly scoped by user_id. Internal admin operations are protected by JWT authentication and admin privilege, with owner-only checks on the most sensitive actions.

Verify it yourself — don’t just trust the claim

Security should not be a promise in a PDF. With your own API key, the two requests below confirm every guarantee above in real time:

# 1) Self-serve attestation for your account
curl https://tokentable.asia/v1/security/attestation \
  -H "Authorization: Bearer tt-live-..."

# 2) Confirm it live on any request — read the headers
curl -i https://tokentable.asia/v1/chat/completions \
  -H "Authorization: Bearer tt-live-..." \
  -H "Content-Type: application/json" \
  -H "X-TT-Confidential: true" \
  -d '{"messages":[{"role":"user","content":"hi"}]}'

# Response headers you can verify:
#   X-TT-Data-Retention: none        (prompt & response never stored)
#   X-TT-Log-Scope: metadata-only    (model, tokens, latency only)
#   X-TT-No-Training: true           (content never used to train)
#   X-TT-Processed-Region: HK | SG
#   X-TT-Confidential-Mode: on | off

The attestation endpoint returns your account’s current data-handling posture (retention, logging scope, training use, processing region, confidential-mode state); the response headers let you re-confirm the same facts on every real request — the static endpoint and the live headers always agree.

Compliance documents

For enterprise customers we provide a Data Processing Agreement (DPA), a summary of each provider’s zero-data-retention (ZDR) commitments, and a security whitepaper for your procurement and legal review. Contact us to request them.