Data and privacy
This page describes what the code running at Model Gateway’s base URL does with data today.
What Model Gateway stores
Everything is stored under the person’s Granite id (owner_uid). Model
Gateway learns no email address or name.
| Data | Contents |
|---|---|
| Provider credentials | Provider, label, the key’s last four characters, and the key itself, encrypted. |
| Custom adapters | Name, dialect, base URL, auth style and model list, unencrypted. |
| Spend grant counts | For each Granite spend grant used: the grant’s id and the units used so far. Granite stores the grant itself. |
| Usage records | Grant, resource, units and time, one per counted model call. |
| Call approvals | For each model call: grant, resource, units and a key that makes a retried call count once. |
Spend grants made through Model Gateway’s earlier spend-grant endpoints, removed in November 2026, are still stored (credential, resource, the app and agent named, limit, units used, and whether revoked), but nothing reads them.
Model Gateway does not store prompts or model responses. It passes them between the caller and the provider and keeps neither.
The key. Before storing a provider key, Model Gateway encrypts it with a dedicated encryption key in AWS’s key management service, bound to the person, the credential and the provider, and for a custom adapter to the credential’s destination. The database is also encrypted at rest. The API never returns the key. Model Gateway decrypts it only to make a model call on a grant that uses that credential. The database is in Stackwell’s separate data-vault AWS account, and the encryption key stays in Model Gateway’s own, so nothing in the vault can decrypt a key. Stackwell staff with access to both could decrypt it.
Where. Model Gateway runs on AWS in the us-east-1 region (United
States); backups are also copied to us-west-2. A model call sends the prompt and the person’s key to the provider
the credential names, or to the custom adapter base_url the credential
copied when it was created; that provider’s own terms then apply.
Logs. Operational logs are kept for 14 days. When Granite does not approve
a grant, the log line records the caller’s x-user-id, the agent and the
Granite grant id.
How long
Model Gateway deletes nothing on a schedule. Spend grant counts, usage records, call approvals and the earlier spend grants are kept indefinitely. The database has point-in-time backups going back 35 days, and daily backups kept for 35 days.
Model Gateway itself cannot delete a database row: in the data vault, a row is removed only through a request that a Stackwell owner approves by email. Deleting through the API marks the record deleted instead, as below.
Who sees what
- A caller acting for the person (an agent with the person’s Granite grant) can list all of the person’s credentials (without the key), custom adapters and usage, including records another caller created, and can delete credentials and custom adapters.
- The provider sees each call made with the person’s key.
- No endpoint lists data across people.
What deleting does
- Deleting a provider credential removes its encrypted key and marks the credential deleted: no endpoint shows it again, and spend grants that name it can no longer be used. The rest of the record (provider, label, the key’s last four characters, times) is kept.
- Deleting a custom adapter marks it deleted: no endpoint shows it, and its name is free to use again. Its record is kept until an adapter of the same name replaces it. Credentials created from it keep their destination; delete them to stop them.
- Revoking a spend grant happens in Granite and stops it being used; Model Gateway keeps its count.
Not yet:
- No account deletion or export. There is no way to delete all of a person’s data at once, and no export beyond the list endpoints.
- Spend grant counts, usage records, call approvals and the earlier spend grants can’t be deleted.
- Deleting the person’s Granite or ChirpAuth account does not delete their Model Gateway data. Once their Granite account is deleted, their Granite grants no longer verify, so no caller can reach the data, but it stays stored.
- Backups keep deleted credentials, with their encrypted keys, for up to 35 days.
- The earlier copy of the database, kept unchanged since the November 2026 move to the data vault, still holds the credentials that existed then, with their encrypted keys, until it is removed.