Sign up
Docs menu

Privacy and logging

This page states what the API records. The Privacy Policy is the legal document; this is the engineering fact behind it.

Per request, Sator logs#

  • One request line: the request id, the HTTP method, the path, and the status code. The path is recorded only when it is one of the public API paths; anything else is logged as other.
  • For a billed request, one usage line: the request id, the model, which endpoint, the token counts (input, cached, output), the cost, and whether the count was estimated.
  • On an unhandled failure, one error line with the request id and the failure's own message — which never contains a body, because bodies are kept out of errors (below).

All of it is metadata. None of it is what you sent or what came back.

Per request, Sator never logs#

  • The request body. Not the prompt, not the messages, not the tools, not the images.
  • The response body. Not the completion, not the tool calls, not the reasoning.
  • Any fragment of either. A body that fails to parse is discarded without its contents ever being placed into an error message, because runtime error messages tend to embed the text they choked on.
  • Your API key. Only a SHA-256 hash of the key and its last four characters are stored, at creation. The key itself is never written anywhere after the response that showed it to you.

What is recorded for billing#

For each billed request: the request id, the model, the API key it was made with, the token counts (input, output, cache read, cache write), the cost, and the day. This is what the dashboard's spend-by-day, by-model and by-key tables are built from and what your balance is debited by. Token counts are numbers; no text is stored with them.

Conversation routing#

Keeping a conversation on a warm cache (see Prompt caching) uses a SHA-256 hash of the model and the first two messages, truncated before hashing. The hash is a routing label; the messages it was derived from are not kept. A prompt_cache_key or x-session-id you supply is likewise hashed together with your account id before it is used or forwarded.

Support#

When you quote an x-request-id to support@princep.org, what we can see is the log line above and the billing record: when it happened, which model, how many tokens, what it cost, and the status. We cannot see what you sent or what came back, because it was never stored.