Prompts and responses
The gateway application is designed not to persist prompt or response text. It validates and processes content in memory to dispatch a request and return the answer. It does not offer stored conversation history, response replay, or prompt-content analytics.
This application behavior is only one part of the path. Before a route can support the production zero-data-retention promise, Accountable must also verify the model provider, infrastructure, telemetry, caching, and fallback behavior.
Metadata that is retained
- Workspace and key identifiers, model alias, timestamps, and request state
- Input/output token counts, settled charges, and credit reservations
- Policy version/hash, effective classification, allowed purpose, and denial reason
- Idempotency key and a request fingerprint used for duplicate detection
- Account, agreement, authentication, and payment records needed to operate the service
Do not embed PHI in names, key labels, idempotency keys, or other metadata. Operational metadata is still sensitive and needs appropriate access controls. A production retention schedule and customer data lifecycle remain launch requirements; no deletion deadline is promised by this preview.
Provider controls
No-training commitments, store:false, and a BAA are different controls. None alone proves end-to-end ZDR. Accountable must verify the effective account/project settings and the exact model, endpoint, region, caching, and safety-processing behavior. Customer-selected fallback providers are not supported.
Your own copies
Your framework, SDK, tracing system, browser, error collector, or application database can store content independently. Remove sensitive payloads from client logs and telemetry. If you store conversations in your application, manage that storage under your own data-handling policy.
Evidence and limits
The workspace exposes healthcare status and metadata-only audit records. A local hash-chain check detects certain integrity changes but is not an independent compliance certification. Internal synthetic tests have checked selected deployed paths; they are not approval for arbitrary models or features.