Privacy Notice

The short version

What we process, and why

The last row is the one that distinguishes this notice from most. It is not a promise about restraint; it is a property of the schema, checked by a build guard that fails on any unconstrained text field.

Your content, specifically

What happens during a request

Your request exists in our process memory while we relay it to the model endpoint you asked for. This is true of any gateway, proxy or load balancer, and any service claiming otherwise is describing something that cannot exist.

What is within our control is what happens next, and the answer is nothing: no code path writes it to disk, to a log, to an error report or to a metric. The error paths — where this leaks in practice — are covered by the same guard as the success paths.

If you enable the vault

At stream close the content is sealed with AES-256-GCM under a fresh data key, that key is wrapped to a KMS key you control, the ciphertext is written, and the plaintext is zeroed. We hold nothing that opens it. In customer_bucket mode the ciphertext is written into your own storage and we hold nothing at all.

Reasoning content

Where a model emits reasoning text, it is treated exactly like response content: never retained by us, and sealed under your key if the vault is on. Where a vendor does not emit it, we record only the token count, because that count affects your bill.

Who we share with

Your request content goes to exactly one party: the model endpoint that serves it, chosen according to your policy, and named on the receipt. Nowhere else. Not to an analytics provider, not to an observability vendor, not to a model of our own.

Your metadata is processed by the infrastructure subprocessors listed on the Trust page. We do not sell personal data, and we do not share it for advertising.

We will disclose data in response to a valid legal demand. Where we are permitted to, we will notify you first so you can object. Our ability to comply is constrained by design rather than by policy: we cannot produce content we cannot read.

International transfers

The jurisdiction that processes a request is the jurisdiction of the endpoint that serves it, and you control that with the residency setting in your policy. A request marked eu can only be served by an EU endpoint; if none is eligible, the request is refused rather than transferred.

Standard Contractual Clauses apply where a transfer outside the EEA or UK occurs. Because every transfer is recorded on a receipt naming the endpoint and its jurisdiction, “which transfers occurred, and where” is a query you can run rather than a question you have to ask us.

Your rights

Subject to applicable law you may request access, correction, erasure, restriction, portability, and may object to processing based on legitimate interests. Write to privacy@prismux.com; we will respond within 30 days.

Some of these are unusually simple here:

• Erasure of content — in off mode there is nothing to erase. In customer_bucket mode it is governed by your own lifecycle policy and we have nothing to delete. Only managed mode requires us to act, and there it is a ciphertext delete.
• Portability — your receipts and vault are exportable at any time, in open formats, at no charge.
• Access — your dashboard already shows the metadata we hold about your usage; there is no privileged internal view you cannot see.

Children

The Service is not directed to children and we do not knowingly process their personal data. It is a developer infrastructure product sold to organisations.

Contact

privacy@prismux.com for privacy enquiries and rights requests. security@prismux.com for vulnerability reports. The controller entity, its registered address and any EU/UK representative will be named here on incorporation — we would rather leave it visibly blank than name an entity that does not yet exist.