Inference API data policy

Last updated: November 4, 2026

This policy covers the Scannit Inference API, operated by Scannit Inc. ("Scannit", "we"). It applies whether you reach the API directly or through a router such as OpenRouter. For our website, see our Privacy Policy.

Summary

• We do not store prompts or outputs.
• We do not train on them, review them or share them.
• They are processed only inside hardware-isolated confidential computing environments.
• We keep operational metadata, with no content, for 90 days.

How requests are processed

Every request is handled inside Intel TDX confidential virtual machines. The model runs on an NVIDIA GPU with confidential computing enabled.

• TLS connections end inside these environments.
• Prompts and outputs exist only in their encrypted memory while your request is being served.
• The host system, our operators and the data center can't read that memory.

This protects your data from the host, the operator and the facility. It doesn't cover what happens to your data before it reaches us or after it leaves.

Prompt caching

To serve repeated context faster and cheaper, the model keeps a prefix cache in GPU memory inside the confidential environment. Cache entries are evicted automatically as new requests arrive. They are never written to disk and never accessible outside the environment.

What we keep

We keep the following metadata for each request, for billing reconciliation, capacity planning and incident response:

• timestamp;
• model;
• input, cached-input and output token counts;
• latency;
• status code;
• request ID.

It contains no prompt or output content, and we delete it after 90 days.

What we do not do

• We do not log, store or back up prompts or outputs.
• We do not use them to train or improve models.
• No human reviews them.
• We do not sell or share them.
• We do not scan content. We enforce our Acceptable Use Policy through rate limits and metadata only.

Through OpenRouter

When you use our models through OpenRouter, OpenRouter is our customer and forwards your request to us. OpenRouter's own privacy policy and data settings govern what OpenRouter does. We receive only what OpenRouter sends with the request.

Service providers

Our servers run in third-party data centers, on hardware we own or lease. Our network and DNS providers carry encrypted traffic and resolve our domain. None of them receives prompt or output content.

Legal requests

Because we hold no prompt or output content, we can't produce it. We disclose metadata only when the law requires it.

Changes and contact

We will post changes here and update the date above. Questions: privacy@scannit.io.