Security
Your data stays where you put it.
US
region: "us"us-east · us-central
- ✓US data centres
- ✓US-resident operations staff
- ✓Data never leaves the US
CA
region: "ca"ca-central · ca-west
- ✓Canadian data centres
- ✓Designed around PIPEDA and Quebec Law 25
- ✓Data never leaves Canada
Commitments
Zero retention by default
Prompts and completions are processed in memory and dropped when the response is sent. Opt-in request logging exists for debugging, off unless you turn it on, and stays in your region.
Never used for training
Nothing you send is used to train or tune any model: ours, a lab's, or anyone else's. That's in the terms, not just a setting.
Region pinned per key
Every key belongs to us or ca. Requests on that key are served, logged and billed only in that country. A mismatched region returns 409 rather than silently crossing a border.
Encrypted everywhere
TLS 1.2+ in transit. Encryption at rest for account data, usage records and any opt-in logs.
Least-privilege keys
Keys are scoped to a region, can carry a hard budget, and can be revoked instantly by you or your agent.
Open weights, verified
Models are pulled from the lab's official release and checksummed before they're served.
Compliance
Reports on request.
We're working toward SOC 2 Type II. Current policies, our subprocessor list and a data processing agreement are available on request, and we'll publish audit status here as it lands.
Security reports: security@scaledthought.com