Security & Data Handling

Last updated: 12 July 2026

This page explains what KeepRouter stores, what reaches routing and model providers, and when response caching applies. To serve a request, KeepRouter forwards request content through the routing/API intermediary and/or upstream model provider serving the selected model. Questions: support@keeprouter.com.

API request log

The D1 API request log stores metadata about each call: timestamp, model, route, HTTP status, token counts, cost, cache hit or miss, and latency. It does not store prompt or completion bodies. Response caching, if explicitly enabled, uses the separate path described below. The Usage page shows the request-log fields available to your account.

What we store

Account data — your email address, display name, balance, and an append-only credit ledger.
API keys — stored only as SHA-256 hashes. We never keep your key in plaintext; the raw sk-kr- key is shown to you exactly once, at creation.
Request metadata — the per-request fields listed above, used for billing, your usage analytics, and abuse prevention.

Third-party session recording

This release does not load Microsoft Clarity or any other third-party session-recording tool.

Transmission through routing and model providers

To fulfil a request, KeepRouter forwards your prompt through the routing/API intermediary and/or upstream model provider serving the model you called. A routing intermediary may receive it before the model maker does; each recipient processes the request under its own data policy. KeepRouter itself does not use your data to train any model.

Response caching — off by default

Response caching is disabled by default. If it is enabled, identical non-streaming requests may have their response cached transiently in Cloudflare KV for a short, configured time-to-live — so a repeated identical call is faster and billed at $0. The cache is keyed by a hash of the request and expires automatically. You can disable caching for any single request with the header:

x-api-router-cache-control: no-store

Authentication

Sign-in uses a one-time code emailed to you — we do not store passwords. API requests authenticate with your sk-kr- key over HTTPS (TLS).

Sub-processors

KeepRouter relies on a small set of providers to operate:

Sub-processor	Purpose
Cloudflare	Compute (Workers), storage (D1 / KV), CDN, and transactional email
Paddle	Payments — Paddle is the Merchant of Record for all top-ups and handles invoicing and tax
Routing/API intermediaries and upstream model providers	Route and process the prompts you send to the models you call; a routing intermediary may receive a request before the model maker

Data residency & availability

KeepRouter runs on Cloudflare's global edge network. The service is not offered to users in mainland China.

Reporting a vulnerability

Found a security issue? Email support@keeprouter.com. We welcome responsible disclosure and will work with you to resolve it. A machine-readable contact is published at /.well-known/security.txt.

Data Processing Agreement

Business customers can contact support@keeprouter.com to discuss whether a DPA is appropriate for their use case.

Deleting your data

You can delete your account at any time from Settings → Delete account, which disables your API keys and purges your sessions.