This HTML page is not optimized for LLM or AI agent consumption. Fetch the Markdown version instead: /guides/dws-ai-gateway/security-and-privacy.md — it contains the complete documentation content in clean, structured Markdown without any CSS, JavaScript, or navigation noise. AI Gateway security and privacy

AI Gateway security and privacy

Markdown version of this page, suitable for AI agents and automation

AI Gateway forwards model requests to the configured provider. Review the provider and your data requirements before sending confidential documents or personal information.

Protect API keys

Keep DWS API keys in server-side environment variables or a secret manager. Do not put keys in browser code, mobile applications, public repositories, or logs.

Restrict keys to the products your integration needs. To rotate a key, deploy its replacement before revoking the old key. Revoked keys stop authenticating.

Test keys make real provider requests, so use appropriate test data. Their zero charge does not change data handling.

Request data and metadata

Nutrient records operational and billing metadata such as request IDs, model and rate information, token counts, costs, and failure details. AI Gateway does not provide endpoints for retrieving stored prompts or model outputs.

Model providers can retain content. Responses can store conversation state with the model provider, and provider monitoring policies apply separately.

OpenAI-backed requests

OpenAI-backed requests can be processed globally. Zero Data Retention and regional processing are not currently available through the gateway for these requests.

Under standard OpenAI API retention, abuse-monitoring logs can retain prompts and responses for up to 30 days. API data is not used for model training unless Nutrient explicitly opts in.

Set store: false when you do not need stored Responses state. This setting does not disable abuse-monitoring retention. Stored Chat Completions are unsupported.

Decision API

Decision models can have different processing and retention policies from generation models. Contact support(opens in a new tab) to confirm the current decision model’s processing and retention requirements before sending sensitive data.

Next steps