---
title: "AI Gateway security and privacy"
canonical_url: "https://www.nutrient.io/guides/dws-ai-gateway/security-and-privacy/"
md_url: "https://www.nutrient.io/guides/dws-ai-gateway/security-and-privacy.md"
last_updated: "2026-10-14T00:00:00.000Z"
description: "Review AI Gateway credentials, request metadata, provider retention, and Responses storage limitations."
---

# AI Gateway security and privacy

AI Gateway forwards model requests to the configured provider. Review the provider and your data requirements before sending confidential documents or personal information.

## Protect API keys

Keep DWS API keys in server-side environment variables or a secret manager. Do not put keys in browser code, mobile applications, public repositories, or logs.

Restrict keys to the products your integration needs. To rotate a key, deploy its replacement before revoking the old key. Revoked keys stop authenticating.

Test keys make real provider requests, so use appropriate test data. Their zero charge does not change data handling.

## Request data and metadata

Nutrient records operational and billing metadata such as request IDs, model and rate information, token counts, costs, and failure details. AI Gateway does not provide endpoints for retrieving stored prompts or model outputs.

Model providers can retain content. Responses can store conversation state with the model provider, and provider monitoring policies apply separately.

## OpenAI-backed requests

OpenAI-backed requests can be processed globally. Zero Data Retention and regional processing are not currently available through the gateway for these requests.

Under standard OpenAI API retention, abuse-monitoring logs can retain prompts and responses for up to 30 days. API data is not used for model training unless Nutrient explicitly opts in.

Set `store: false` when you do not need stored Responses state. This setting does not disable abuse-monitoring retention. Stored Chat Completions are unsupported.

## Decision API

Decision models can have different processing and retention policies from generation models. Contact [support](https://support.nutrient.io/) to confirm the current decision model’s processing and retention requirements before sending sensitive data.

## Next steps

- [API reference](https://www.nutrient.io/api/reference/ai-gateway/public/) — Request schemas and supported features.

- [Nutrient privacy policy](https://www.nutrient.io/legal/privacy/) — Review Nutrient’s general privacy policy.

- [Support](https://support.nutrient.io/) — Discuss your integration’s data requirements.
---

## Related pages

- [DWS AI Gateway API](/guides/dws-ai-gateway.md)
- [AI Gateway errors and limits](/guides/dws-ai-gateway/errors.md)
- [Get started with DWS AI Gateway API](/guides/dws-ai-gateway/getting-started.md)
- [AI Gateway pricing](/guides/dws-ai-gateway/pricing.md)
- [Make decisions with the decision API](/guides/dws-ai-gateway/system-one.md)