Your data stays yours.
How Ruliad handles the data that businesses and developers send through our API and platform: what we keep, for how long, who processes it, and how we protect it.
We don't train on your data
Inputs and outputs sent to the API or the playground, and anything else your business shares with us, are never used to train or improve models: ours or anyone else's.
Request content isn't stored
Inputs and outputs pass through our gateway to a GPU worker and back. They are not written to disk, databases or logs. A worker may hold an input in memory for a few minutes so a follow-up call can refer to it, then discards it.
Metadata only, with an expiry
For billing, limits and reliability we keep request metadata (time, model, sizes, credits, latency, status): never the content. Analytics events are deleted automatically after 400 days.
Payments handled by Stripe
Card details go straight to Stripe and never touch our servers. Invoices and receipts come from Stripe too.
What we keep, and for how long
| Data | Where | How long |
|---|---|---|
| Request content (inputs and outputs) | Not stored | — |
| Request metadata for analytics | Our analytics database (Germany) | 400 days, then deleted automatically |
| Usage charges, credit ledger, payments, invoices | Account database | As long as tax and accounting law requires |
| Account details (name, email, API key hashes, settings) | Account database | While the account is open, and up to 90 days after it closes |
| Database backups | Cloudflare R2, encrypted at rest | 30 days, then deleted automatically (analytics backups: 14 days) |
| Security and server logs | Our servers and providers | Up to 12 months |
| Emails we send you | Resend | Delivery records kept by Resend under its own retention policy |
Zero retention of request content is the default for every customer: inputs and outputs are never stored. Business customers who need shorter retention of request metadata can set it in their agreement; write to privacy@ruliad.co.
Training
We do not use Customer Content (API and playground inputs and outputs) or other business data to train or improve any model. We do not sell it or share it for advertising. This is a commitment in our Privacy Policy and Data Processing Addendum, not a setting you have to find.
Security
- Encryption in transit (TLS) on every connection. Our API gateways are reachable only through Cloudflare's network, over authenticated tunnels with no open inbound ports.
- API keys are stored only as SHA-256 hashes and shown once, when created. Secrets used by our own systems are encrypted at rest.
- Every request is checked against your key, limits and prepaid balance before it runs, and charged on the server, never by the client.
- Least-privilege access: analytics ingestion uses write-only credentials; internal tools sit behind Cloudflare Access plus invite-only sign-in, and every administrative action is audit-logged. Production changes need an owner's approval.
- Our source code and server images are private. Model files are served from private storage.
- Monitoring and alerting around the clock; API gateways in the European Union and the United States.
- Nightly backups of the account database to separate storage, each one verified by an automated restore test.
- If a personal-data breach affects your content, we tell you without undue delay and within 72 hours (Data Processing Addendum, section 6).
- Certifications: we do not hold SOC 2 or ISO 27001 certification today. On request we share this security overview, our Data Processing Addendum and answers to your security questionnaire (security@ruliad.co).
Where data is processed
| API gateways and GPU workers | European Union and United States (requests are served from the region closest to you) |
| Account and billing database | [to decide: Prisma Postgres region] |
| Analytics and operations | Germany (Hetzner) |
| Website | Vercel (United States and European Union) |
Transfers out of the European Union are covered by the European Commission’s Standard Contractual Clauses where the law requires.
Subprocessors
The companies that process data for us, what each does, what data it sees and where, are listed on our Subprocessors page. We give at least 30 days’ notice before adding one. Our operations team uses Anthropic’s Claude to analyse incidents and usage: it sees operational metrics and account and usage figures, never request content, and Anthropic does not train on data sent through its commercial API.
For businesses
- Our Data Processing Addendum is part of our terms; write to privacy@ruliad.co for a countersigned copy.
- Access, export or deletion of your data: privacy@ruliad.co. We answer within 30 days.
- Security questionnaires and due diligence: security@ruliad.co.
Report a vulnerability
Write to security@ruliad.co with what you found and how to reproduce it. Please give us a reasonable time to fix it before disclosing it. We do not take legal action against good-faith research that respects our users’ privacy and data.