Data handling
The design is zero data retention: no inference logs, and prompts are never used for training. That is not the same as "nothing remains". This page lists what is kept, where and for how long, from the code that writes it.
The prompt's path
- The edge (api.kotoba.cloud) validates the request, runs guardrails and hands the prompt to the private authority. Edge logs carry numbers only (job id, token counts, refusal codes) — never prompt text.
- The authority writes a **job record** in the principal's own Durable Object: the request (messages, tools, max_tokens), the state, the answer text or tool_calls, and the provider's usage receipt (token counts). This record is what lets a retry re-attach and a paid job settle from a receipt.
- The inference origin (dedicated route, shared route) processes the prompt in memory and returns the answer. Which providers stand behind a route is operator configuration, not public policy.
Kept / never kept
| Data | Where | How long |
|---|---|---|
| Job records (prompt, answer, tool_calls, usage) | The principal's private authority storage | Deleted automatically 24 hours after the terminal state (succeeded / failed); a job that never reached one, 24 hours after creation. After deletion an identical request becomes a new job. |
| Verification status, expiry, evidence reference | Same | Expires after 365 days. The evidence itself (documents, card) lives at Stripe only. |
| AML/CTF screening status | Same | Expires after 24 hours. |
| Guardrail / firewall refusal receipts | Same | As audit log, 180 days (auditLogRetentionDays at /v1/secure). |
| Free-quota counters (daily) | Same | Overwritten the next UTC day. |
| Prepaid ledger (grants, holds, settlements, receipt ids and token counts) | The principal's BillingAccount | Kept as financial history (never erased). Contains no prompt text. |
| Payment data (card numbers, billing address) | Stripe | kotoba.cloud holds only the customer id and invoice ids. |
| Inference logs, training data | — | Never created. |
Who can read it
- You: /v1/research/status (state), /v1/research/job?jobId= (your own jobs), /v1/billing/status (balance) — the same principal only, by PAT or cookie.
- Operators: HMAC-signed review operations (admin origin) change state; there is no public route that reads job text.
- Other principals: nothing (jobs are bound to their principal — job-owner-mismatch).
Boundaries
- The server executes no tools, code, commands or network actions. tool_calls are returned as text; execution is your agent's.
- Content screening (CSAM, CBRN, fraud-as-a-service) runs in memory; only a block is recorded.
- Data residency is unspecified (dataResidency at /v1/secure).
GET https://api.kotoba.cloud/v1/secure
→ {"compliance": {"auditLogRetentionDays": 180, "dataResidency": "unspecified", "zeroDataRetention": "designed-for-zdr", ...}}Job records are gone after 24 hours (the research authority's retention alarm, since 2026-09-15). "ZDR" means no inference logs, no training, and text that is gone within 24 hours; what the ledger and the audit log keep are numbers and ids.