Data Privacy & Zero Data Retention (ZDR)
Nicrron is engineered specifically for privacy-sensitive enterprises, healthcare providers, and financial institutions requiring strict data sovereignty and zero prompt persistence.
1. Zero Data Retention (ZDR) by Default
For chat completions, embeddings, and audio, Nicrron operates purely as an in-memory streaming proxy. When you submit a request, prompt chunks and response tokens are processed entirely in volatile RAM and immediately discarded once the HTTP stream concludes.
- No Prompt Storage: Chat prompts, system instructions, and messages are never saved to disk, databases, or object storage.
- No Model Retraining: Nicrron never trains on your data, and we route only to providers' commercial API endpoints, whose terms exclude training on API traffic by default.
- In-Memory Transit Only: SSE token streams are piped directly from upstream providers to your client with sub-10ms buffer latency.
Media Generation Exception
Video and image generation is not eligible for ZDR. These jobs run asynchronously after your request returns, so the prompt is stored with the job record and the generated output is retained on our servers for 30 days so you can retrieve it — then both are automatically and permanently deleted. This 30-day window is a feature: you can re-download any generation for a month without re-paying.
Built for Compliance-Sensitive Workloads
Because chat prompt text and completion tokens are never written to our persistent storage layers, there is no stored payload for a breach, subpoena, or audit to expose — which materially simplifies GDPR/CCPA data-mapping and vendor reviews. Nicrron has not yet undergone a SOC 2 audit and does not sign BAAs; evaluate suitability for regulated data accordingly.
2. Metadata-Only Telemetry & Logs
To provide real-time dashboard analytics, billing settlements, and provider uptime metrics, Nicrron logs strictly non-sensitive metadata:
3. Redis Cache Cryptographic Isolation
When Exact Caching is active (for deterministic queries at temperature: 0), cache keys are generated using a one-way SHA-256 hash of your request parameters. Cache records are isolated per organization, encrypted, and automatically purged based on TTL expiry.
4. AES-256-GCM Key Encryption
All upstream provider keys and Nicrron secret keys are encrypted using AES-256-GCM authenticated encryption at rest. Keys are decrypted solely in-memory within isolated gateway runtime memory and never exposed in logs or client bundles.