Your data doesn't live here.
Prompts are processed in memory and discarded. No storage, no training, no logs of your content. That's not a policy: it's the architecture.
How Your Data Stays Yours
Autark stores nothing
Your prompts exist in memory during inference only. Once the response is returned, they're gone. We don't log prompt content, we don't store it on disk, and we never use it for training.
- Prompts processed in memory, never written to disk
- No prompt data used for model training, ever
Compliance Metadata Only
We log operational metadata: timestamps, token counts, model IDs: for billing and monitoring. Your prompt content is never stored, logged, or accessible.
- Billing logs: tokens, model, timestamp: no content
- Monitoring: latency, error rates, provider health
Model servers differ in what they can promise
Autark is an OpenAI-compatible API that routes requests to third-party model providers. Your prompts transit through these providers in memory only, and Autark never stores them. But not every provider contractually guarantees zero retention on their own side.
- Standard tiers route to the fastest available server, which may include providers without a zero-retention commitment.
- -private tiers restrict routing to servers that contractually guarantee zero retention. Same models, same integration, narrower path.
See the full subprocessor list for which providers carry a zero-retention commitment.
Infrastructure Standards
Autark runs on infrastructure built for enterprise compliance.
SOC 2 Type II
Via infrastructure partners
ISO 27001
Via infrastructure partners
GDPR
EU data protection compliance
Our infrastructure partners maintain independent SOC 2 Type II and ISO 27001 certifications. As an API platform, Autark inherits their certified infrastructure. Full partner certification details are available under NDA — [email protected]. We are actively working toward our own independent SOC 2 Type II attestation.
HIPAA compliance is available through our infrastructure partners' Business Associate Agreements (BAAs). Contact [email protected] for BAA execution.
Platform Security
Encryption
- • TLS 1.3 for all data in transit
- • AES-256 encryption at rest
- • No persistent prompt storage
- • Ephemeral memory-only processing
Infrastructure
- • Dedicated VPC deployment available
- • Workload isolation per customer
- • Automated security patching
- • DDoS protection & rate limiting
Access & Auditing
- • API key authentication
- • Key rotation & revocation
- • Usage audit logs per API key
- • Spend caps & budget controls
Incident Response
If something goes wrong, we contain it quickly and keep you informed.
Our process
- • 24/7 monitoring & alerting on platform and provider health
- • Severity classification and triage on a defined SLA
- • Containment, eradication, and recovery by on-call engineering
- • Root-cause analysis and post-incident review
Notification commitments
- • Affected customers and the relevant supervisory authority notified within 72 hours of becoming aware (GDPR Art. 33/34)
- • Notifications sent to your account email
- • Dedicated security contact: [email protected]
- • Coordinated status updates through to resolution
Security Testing & Disclosure
We test our own defenses and give researchers a safe path to report issues.
Penetration testing
- • Independent third-party penetration testing of the Autark platform
- • Continuous dependency and vulnerability scanning
- • Automated security patching of infrastructure
- • Executive summaries available to enterprise customers under NDA — [email protected]
Responsible disclosure
- • Report vulnerabilities to [email protected]
- • Machine-readable policy at /.well-known/security.txt
- • Safe harbor for good-faith research
- • We acknowledge reports and coordinate on remediation timelines
Questions?
Our team is here to help with security questionnaires, compliance requirements, or enterprise deployment questions.