{
  "schema_version": 5,
  "updated": "2026-10-11",
  "service": "ScaledThought",
  "page": "https://scaledthought.com/security",
  "llms_txt": "https://scaledthought.com/llms.txt",
  "data_retention": {
    "prompts_and_completions": "none",
    "used_for_training": false,
    "batch_and_fine_tuning_files_max_days": 30,
    "details": [
      {
        "data": "Prompts and completions",
        "kept": "Not stored",
        "detail": "Processed in memory to produce the response, then discarded. They aren't written to logs."
      },
      {
        "data": "Batch and fine-tuning files",
        "kept": "At most 30 days",
        "detail": "Stored encrypted in your region until you delete them or 30 days after upload, whichever comes first."
      },
      {
        "data": "Fine-tuned models",
        "kept": "Until you delete them",
        "detail": "Private to your account."
      },
      {
        "data": "Usage records",
        "kept": "Life of the account",
        "detail": "Model, token counts, cost and timings, for billing. No content."
      }
    ]
  },
  "regions": [
    {
      "code": "us",
      "country": "United States",
      "status": "open",
      "api_base_url": "https://api.us.scaledthought.com/v1"
    },
    {
      "code": "ca",
      "country": "Canada",
      "status": "coming_soon",
      "api_base_url": "https://api.ca.scaledthought.com/v1"
    }
  ],
  "residency": {
    "key_prefix_decides_region": true,
    "wrong_region": {
      "status": 421,
      "code": "wrong_region",
      "returns": "base_url"
    },
    "payments": "Stripe, United States, for both regions"
  },
  "response_headers": [
    {
      "name": "x-st-region",
      "example": "us",
      "on": "Every API response, errors included",
      "meaning": "The region that served the request."
    },
    {
      "name": "x-st-data-retention",
      "example": "none",
      "on": "Every API response, errors included",
      "meaning": "Prompts and completions from this request are not stored."
    },
    {
      "name": "x-st-request-id",
      "example": "01K5Z3T8R2V9Q4M6N1P7B0C8XD",
      "on": "Inference responses",
      "meaning": "The request's id, for usage records and support."
    }
  ],
  "we_never": [
    {
      "title": "Store request content",
      "body": "Prompts and completions of API requests are processed in memory and discarded. Batch and fine-tuning files, including batch results, are deleted within 30 days."
    },
    {
      "title": "Log content",
      "body": "Prompts and completions never go into logs, traces, metrics, analytics or error messages. Usage records hold counts, costs and timings."
    },
    {
      "title": "Train on your data",
      "body": "We don't use your prompts, completions or files to train models, except a fine-tune you start for your own private model."
    },
    {
      "title": "Fail over to the other region",
      "body": "When a region is busy or down, its requests are never sent to the other region."
    },
    {
      "title": "See your card number",
      "body": "You enter it on Stripe's payment page; it never reaches our servers."
    },
    {
      "title": "Sell personal information",
      "body": "We don't sell it. The Privacy Policy says what we share, with whom and why."
    }
  ],
  "protection": [
    {
      "title": "Encryption in transit",
      "body": "Traffic to our API uses TLS 1.2 or later, and every hop that carries your prompts, completions or keys inside our network is encrypted too. Database connections verify the server's certificate."
    },
    {
      "title": "Encryption at rest",
      "body": "Databases, stored files, backups, secrets and logs are encrypted with each region's own encryption keys, held in that region."
    },
    {
      "title": "Separate regions",
      "body": "Each region runs as its own deployment, with its own database, encryption keys and secrets."
    },
    {
      "title": "Backups and logs",
      "body": "Databases are backed up automatically inside their region, kept for 14 days, with point-in-time recovery. Operational logs hold metadata only and are kept for 90 days, in the region."
    },
    {
      "title": "Staff access",
      "body": "Staff sign in with passkeys, and sensitive actions need a fresh passkey check. Every staff action on an account is recorded in an append-only audit log."
    },
    {
      "title": "Payments",
      "body": "Cards are handled by Stripe. We keep Stripe's ids for a payment, never the card number."
    },
    {
      "title": "Pinned models",
      "body": "Every model we host ourselves is pinned to an exact upstream commit and checked before it serves; where the weights have published checksums, every file is hash-verified, so a model we host can't change without us knowing."
    }
  ],
  "development": [
    {
      "title": "Every change is checked",
      "body": "Changes to our code and infrastructure go through pull requests that must pass the tests, secret scanning, dependency vulnerability checks and static analysis before they merge."
    },
    {
      "title": "Nightly scans",
      "body": "Every night we scan our code, dependencies, container images and infrastructure configuration for known vulnerabilities. Findings get a fix-by date by severity: critical 7 days, high 30 days, medium 90 days, low 180 days."
    },
    {
      "title": "Infrastructure as code",
      "body": "Our cloud infrastructure is defined in code. Before each deployment, policy checks refuse any resource outside the region, any publicly readable data store, and any database, bucket, cache, secret store or log bucket without the region's own encryption key."
    },
    {
      "title": "Pinned dependencies",
      "body": "Container base images are pinned by digest and CI actions by commit. Dependency updates are proposed weekly and go through the same checks."
    },
    {
      "title": "Secrets",
      "body": "Service credentials live in each region's secret manager, never in code. Our CLI never takes a secret as a flag."
    }
  ],
  "vulnerability_fix_days": {
    "critical": 7,
    "high": 30,
    "medium": 90,
    "low": 180
  },
  "account_closure": {
    "endpoint": "DELETE /v1/account",
    "billing_records_kept": "6 years",
    "details": "Close the account with DELETE /v1/account (a key with the keys or billing scope). Every key is revoked at once, running batches and fine-tuning jobs are cancelled, fine-tuned models are deleted, and personal data (name, email, key names, files) is erased, unless a legal hold requires us to keep it. Unused purchased credit is refunded automatically once usage has settled; disputed or held payments are handled by our team. Billing and usage records, which hold no names, emails or content, are kept for 6 years, as tax and accounting law requires."
  },
  "backups": {
    "in_region": true,
    "retention_days": 14,
    "point_in_time_recovery": true
  },
  "log_retention_days": 90,
  "service_providers": {
    "published_list": false,
    "list_on_request": "mailto:privacy@scaledthought.com"
  },
  "api_keys": {
    "stored_as": "hash",
    "shown_once": true,
    "scopes": [
      "inference",
      "read",
      "keys",
      "billing"
    ],
    "max_lifetime_days": 365,
    "rotation_with_grace_period": true,
    "self_revocation": true,
    "sub_agent_keys": true,
    "per_key_daily_budget": true,
    "per_key_rate_limits": true
  },
  "vulnerability_disclosure": {
    "contact": "mailto:security@scaledthought.com",
    "policy": "https://scaledthought.com/legal/security",
    "security_txt": "https://scaledthought.com/.well-known/security.txt",
    "acknowledge_within_business_days": 3,
    "security_questionnaires": "mailto:security@scaledthought.com"
  }
}