Your data stays yours: zero retention by default
Before a team sends us production traffic, they want to know what happens to their data. Here's the full answer.
Zero data retention is the default
Every Mixlayer account runs with zero data retention. We process each request in memory and discard its data once inference is done. We don't store your prompts or outputs, and we never use them to train models. You don't have to configure anything or ask for it. It's on for every account.
When something has to be stored
Some features need storage to work. The clearest case is the stored Responses API: if you send store: true, you're asking us to keep the response so a later request can build on it with previous_response_id.
That's useful, but it puts a retention decision in every developer's hands, one request at a time. Most security teams don't want that. So organization admins now control retention for the whole org, under Organization Settings in the console. Admins can:
- keep the default retention period
- choose a custom retention window that matches your own policy
- select Never store, which enforces zero storage across the organization even when a request sends
store: true
The setting applies to every application in the org, so you don't have to audit each codebase to know where you stand.
Responses over WebSockets are a special case. They're held in memory only for the life of the connection, and never persisted after it closes.
Who changed what
Retention policy is only as good as your ability to check it. Mixlayer now keeps an audit log of account activity. Admins can read it through the Platform API, so it can feed whatever your security team already uses.
What's next
We're working through SOC 2 certification. For teams that need inference to stay entirely inside their own infrastructure, we can support on-prem and edge deployments.
If you handle sensitive or regulated data and want to walk through any of this, email us. The zero data retention docs have the details.