engyPrivacy policy
Zero data retention by default: the engy gateway does not store your prompts or your model outputs, and never uses them for training. You can choose to opt out; until you do, nothing about this changes. For zero data retention end to end, including the GPU worker that runs your request, turn on the ZDR flag. This page states exactly what is and is not kept.
Effective 2026-10-17 · contact [email protected]
What we never store
Prompts, completions, tool-call arguments and results, images, embeddings: the content of your requests and responses. Content passes through the gateway to a GPU worker, is processed in memory, and is gone from the gateway when the response is delivered. No request or response content is ever used to train, fine-tune, or evaluate models. The only exception is requests you have opted out, described under opting out. Which GPU worker serves a request, and what that means for your data, is set out under end-to-end zero data retention.
Opting out
Zero data retention is the default for every account, and it stays on unless you turn it off. You can opt out for a single request, or ask us to opt out your whole account. When you do, engy keeps the prompts and model outputs of the requests your opt-out covers. We never sell or publish them. They are used only for engy's own research, such as improving the speculative-decoding models that make inference faster. A request can always keep itself out, even on an opted-out account. See the docs for how to set it.
End-to-end zero data retention: the ZDR flag
The gateway is strict: it keeps no content, on every model. The model itself runs on a GPU worker, and a request can be served by a worker that an independent operator runs on the engy network. Some of those workers run confidential computing, where the CPU and GPU keep request content sealed from the machine's operator. Others do not: their operators accept a no-retention policy as a condition of serving traffic, but they hold administrative access to their own machines, so engy cannot technically guarantee non-retention there.
To guarantee zero data retention end to end, turn on the ZDR flag: per request with "provider": {"zdr": true}, or for an API key or your whole account by asking us. A flagged request is served only by ZDR-certified workers: confidential-computing (CC) workers, or machines engy operates and controls itself, configured so that no request content is logged or kept. When none is available it fails with a 503; it is never sent to any other worker, and its content is never kept, even on an account that has opted out. Models with ZDR-certified workers are marked ZDR on /pricing. Without the flag, do not send data you are unwilling to expose to a third-party operator. See the docs for how to set it; the terms state this as a contractual matter.
What we store
| data | purpose | retention |
|---|---|---|
| usage metadata per request: timestamp, model, token counts (prompt / cached / completion), cost, latency | billing, capacity planning, the usage view in your dashboard | kept while your account exists |
| account data: email, salted password hash, API key hashes and prefixes, credit balance | authentication and billing | kept while your account exists; deleted on request |
| operational logs: connection metadata and error events, no message content | debugging, abuse prevention | rotated on a short schedule |
Integrity audits
engy is a verified-inference network: a sample of responses is cryptographically audited to prove the exact advertised model produced the output. An audit record stores the response's token IDs and the verification result, never the prompt. Audit records are purged within 30 days.
Processing path
Requests reach us through Cloudflare (TLS termination and DDoS protection; Cloudflare processes traffic per its own policies). The gateway then sends each request to a GPU worker: one engy operates, or one an independent operator runs on the engy network. Requests with the ZDR flag go only to ZDR-certified workers (confidential computing, or machines engy operates itself), which hold request content in memory only and keep no copy. See end-to-end zero data retention.
Your rights
Email [email protected] to delete your account and its stored data, or to ask anything about this policy. Material changes to this policy will be posted on this page with a new effective date.