# Data residency and retention

> Where Serenity Edge processes your data, what it keeps, for how long, and what it never does with it.

Source: https://docs.serenityedge.ai/docs/data-residency/

Serenity Edge is built for organisations that need their inference to stay in the European Union, and in Spain in particular. This page describes the data policy in plain terms. The binding version is the [Data Processing Agreement](https://docs.serenityedge.ai/terms/data-processing-agreement/) and the [Privacy Policy](https://docs.serenityedge.ai/terms/privacy-policy/).

## Summary

| Question | Answer |
| --- | --- |
| Are prompts or completions used to train models? | **No.** Never, for any model. |
| Are prompts or completions stored? | **No.** They are processed in memory and never written to disk or logs. Prompt prefixes may be kept in a volatile memory cache for at most 24 hours, then automatically evicted. |
| What is kept? | Request metadata only: timestamps, token counts, model, latency and status, kept for **90 days** for billing and operations. |
| Where does inference run? | On Substrate AI's own GPUs in **Valencia, Spain**. |
| Where are requests handled? | API request handling runs in **Microsoft Azure Spain Central**. |
| Where are authentication and billing processed? | For traffic from a Serenity Star account, by Serenity Star in the EU (**Azure France Central**). |
| Does data leave the EU? | No. All processing described here takes place in the European Union. |

## What happens to a request

1.  Your request reaches the API over TLS and is authenticated.
2.  The prompt is sent to the GPU cluster in Valencia, the model generates the completion, and the completion is streamed back to you.
3.  Once the response is complete, prompt and completion are discarded from memory, except that the prompt prefix may stay in the volatile cache for at most 24 hours. Only the metadata listed above is written to the billing and operations logs.

## Retention, in detail

-   Prompts, completions, tool arguments and tool results are processed in memory and are never written to disk or logs at any point.
-   They are not inspected by staff, not sampled for quality review and not used to train, fine-tune or evaluate any model.
-   To speed up repeated requests, prompt prefixes may be kept in volatile memory (a cache) for at most 24 hours, after which they are automatically evicted. This is what lets repeated prefixes be billed at the cached input price. Cached content is never written to persistent storage, is never used for training, is not accessible to staff and is never shared across API keys.
-   Request metadata contains no message content. It is kept for 90 days for invoicing, abuse prevention and capacity planning, then deleted.

## Access routes and processing locations

-   **Serenity Star account.** Authentication, API key management and billing are processed by Serenity Star in the EU (Azure France Central). Inference and request handling are as described above.
-   **Routers and marketplaces.** The platform (cortecs or EUrouter today) receives your request first and forwards it to Serenity Edge. That platform's own data policy applies to the leg between you and the platform; from Serenity Edge onwards the policy on this page applies. See [Routers and marketplaces](https://docs.serenityedge.ai/docs/access/channels/).
-   **Enterprise.** Same processing locations; the contract can add dedicated capacity and audit provisions. See [Enterprise](https://docs.serenityedge.ai/docs/access/enterprise/).

## Sub-processors

The current list of sub-processors and their locations is published at [Sub-processors](https://docs.serenityedge.ai/terms/sub-processors/).

## Questions

Write to [contact@substrate.ai](mailto:contact@substrate.ai) for data protection questions, requests from data subjects, or to request a signed copy of the Data Processing Agreement.