Data residency and retention

Serenity Edge is built for organisations that need their inference to stay in the European Union, and in Spain in particular. This page describes the data policy in plain terms. The binding version is the Data Processing Agreement and the Privacy Policy.

Summary

Question	Answer
Are prompts or completions used to train models?	No. Never, for any model.
Are prompts or completions stored?	No. Zero retention: they exist in memory for the duration of the request only.
What is kept?	Request metadata only: timestamps, token counts, model, latency and status, kept for 90 days for billing and operations.
Where does inference run?	On Substrate AI's own GPUs in Valencia, Spain.
Where are requests handled?	API request handling runs in Microsoft Azure Spain Central.
Where are authentication and billing processed?	For traffic from a Serenity Star account, by Serenity Star in the EU (Azure France Central).
Does data leave the EU?	No. All processing described here takes place in the European Union.

What happens to a request

1. Your request reaches the API over TLS and is authenticated.
2. The prompt is sent to the GPU cluster in Valencia, the model generates the completion, and the completion is streamed back to you.
3. Once the response is complete, prompt and completion are discarded. Only the metadata listed above is written to the billing and operations logs.

Zero retention, in detail

• Prompts, completions, tool arguments and tool results are not persisted to disk or to any database at any point.
• They are not inspected by staff, not sampled for quality review and not used to train, fine-tune or evaluate any model.
• Prompt caching, which lets repeated prompt prefixes be billed at the cached input price, keeps a short-lived representation of the prefix in GPU memory only; it is not written to persistent storage and it is never shared across API keys.
• Request metadata contains no message content. It is kept for 90 days for invoicing, abuse prevention and capacity planning, then deleted.

Access routes and processing locations

• Serenity Star account. Authentication, API key management and billing are processed by Serenity Star in the EU (Azure France Central). Inference and request handling are as described above.
• OpenRouter. OpenRouter receives your request first and forwards it to Serenity Edge. OpenRouter's own data policy applies to the leg between you and OpenRouter; from Serenity Edge onwards the policy on this page applies. See OpenRouter.
• Enterprise. Same processing locations; the contract can add dedicated capacity and audit provisions. See Enterprise.

Sub-processors

The current list of sub-processors and their locations is published at Sub-processors.

Questions

Write to [email protected] for data protection questions, requests from data subjects, or to request a signed copy of the Data Processing Agreement.