Privacy Policy

At Model Mesh, we design our AI routing gateway with a privacy-by-default architecture. We believe developers and enterprises should have total confidence that their proprietary code, prompts, and customer conversations remain private, secure, and ephemeral.

This Privacy Policy explains what data Model Mesh collects, how it is processed, how we protect it through state-of-the-art cryptography, and the strict controls you possess over your account and telemetry.

• No Disk Logging: Prompt bodies, image attachments, code contexts, and generated completions are never written to Model Mesh persistent databases or log files.
• No Model Training: Model Mesh never uses customer inputs, completions, or embeddings to train, retrain, or evaluate any artificial intelligence models.
• Zero Secondary Monetization: We do not sell, rent, broker, or trade your data or prompt queries to any third party.

To operate our gateway, manage authentication, and handle billing, we collect limited categories of data:

Security is the cornerstone of Model Mesh. We implement defense-in-depth cryptographic controls:

• Irreversible Model Mesh API Keys: When you generate an API key (mm_live_...), the plaintext is displayed to you once. Only its cryptographic hash is stored in our database. It is mathematically impossible for Model Mesh staff or attackers to reverse-engineer your key from our database.
• Contributed Upstream Keys: Any third-party provider key submitted to the Community Pool is encrypted at the edge using AES-256-GCM authenticated encryption with isolated key-management service (KMS) master keys.
• Transit Encryption: All client-to-gateway and gateway-to-upstream communication occurs exclusively over TLS 1.3 with strict HTTP Strict Transport Security (HSTS) and modern cipher suites.

To deliver model inference, Model Mesh transmits requests to downstream upstream providers based on the model ID you specify. These subprocessors are evaluated for enterprise compliance (SOC 2, ISO 27001):

• Foundational Model Providers: OpenAI, Anthropic, Google Cloud Vertex, Groq Cloud, DeepSeek, Together AI.
• Payment Processors: Stripe, Inc. (PCI-DSS Level 1 certified).
• Database & Auth Infrastructure: Supabase / AWS RDS (Encrypted at rest, private VPC).
• Edge & DDoS Protection: Cloudflare Enterprise Edge (DDoS mitigation, web application firewall).

You have complete control over your historical records:

• Usage & Billing Records: Aggregate token counts, cost figures, and invoices are retained for financial and tax audit requirements for as long as your account remains active.
• Account Deletion: You may request full account deletion at any time by emailing privacy@modelmesh.ai or from the dashboard. Upon deletion, all associated keys, profile metadata, and contributed credentials are permanently wiped from production tables within 24 hours.

Regardless of your geographical location, Model Mesh extends unified privacy protections aligned with GDPR and CCPA:

• Right of Access: Obtain a complete export of your personal information and billing history.
• Right to Rectification: Update or correct inaccurate account details directly in the dashboard.
• Right to Erasure (“Right to Be Forgotten”): Permanently delete your profile and credentials.
• Right to Restrict Processing: Suspend or revoke active API keys and pause auto-recharge.
• Right to Non-Discrimination: We will never deny service, charge different prices, or degrade performance if you exercise your statutory privacy rights.

For privacy inquiries, Data Processing Agreements (DPA), or to exercise statutory privacy rights, please contact our dedicated Data Protection Officer: