Privacy and zero data retention
How System One handles request data, retention, and privacy for the hosted API.
This page describes System One hosted API and Playground. Using the open-source SDK with a different service follows that service's data practices; it does not route requests through this API unless you configure that connection.
Answer-ready
Q: Does System One offer zero data retention on the API?
A: See this page for the current System One API retention policy. Do not invent retention claims beyond Product/Legal-approved text.
What happens when you submit a request?
System One uses the context, attached images, instructions, choices, and rating criteria you submit to produce an answer with the selected model. Submitted content, including image bytes, is sent to and processed by model services. Use the service only for information you are authorized to share for that purpose.
This guide does not promise zero retention by model services, that content is never used for training, or that all processing occurs in a particular region. If your organization requires a specific privacy or contractual commitment, contact support@system-one.dev before submitting the affected information.
For current model options and limits, see Choose a model.
Submit only what the question needs
- Remove names, email addresses, account numbers, and other identifiers unless they are necessary for the judgment.
- Use a short relevant excerpt instead of a full customer history when possible.
- Never include passwords, sign-in codes, API keys, or payment-card details in the context or questions.
- Use fictional or anonymized examples while learning in the Playground.
- Treat generated answers as potentially sensitive: they may repeat information from your input.
- Inspect and redact images before attaching them: screenshots and receipts can expose identifiers, credentials, faces or payment details. Base64 is encoding, not encryption or anonymization.
Removing an identifier does not always make a document anonymous. Consider whether the remaining details could still identify a person or reveal confidential information.
What records are retained?
| Information | How it is handled |
|---|---|
| Context, images, instructions, criteria, and other submitted content | Processed to answer your questions. They are not separately persisted as prompt fields or image uploads in System One's decision records, but a provider may echo content, including image data, into its response and thus the replay cache. |
| Request metadata | Includes the request ID, associated account and API key, request hash, model, question count, status, credits, timing, error classification, and optional usage statistics. The decision-record retention policy is 90 days. |
| Successful answer with request recovery enabled | The successful response text, status, and allowed headers are retained for replay for 24 hours from request creation. This can include sensitive output, repeated input, and additional response details—not just the selected answer. |
| Successful answer without request recovery enabled | Returned to you without retaining an answer for replay. This is not a promise that no processing or retention occurs elsewhere. |
| API credentials | A hash and identifying prefix are retained for authentication and management. The full secret is shown only when created and cannot be retrieved later from the key list. |
| Account, purchase, and credit-transaction records | Separate from decision records. At least 90 days of raw credit activity remain online. Older settled System One consumption/refund records may move to private archived storage after verification, without changing balances or historical totals. Other credit types remain online. The decision-record policy does not automatically delete these records. |
Request recovery uses an idempotency key, a label that lets an API connection recover the result of the same request. Playground runs use this mechanism as well, so successful Playground responses are subject to the 24-hour replay retention. It does not mean the Playground offers a button to reopen a previous answer. See Request recovery for optional API use.
Do not put secrets into request identifiers or key names. Retention for replay covers the successful response as a whole, which may contain information you did not expect to be repeated.
Retention and your console history
The 24-hour replay period starts when the request is created, not when you last view or recover its answer. Settled request metadata is subject to the 90-day retention policy. Removal occurs through periodic cleanup, so these periods are not guarantees of deletion at an exact second, nor promises about copies held by model services or backups. Unresolved requests may remain until their status and billing are settled.
The console shows your account's most recent 30 UTC calendar days of activity and the latest 50 requests in that window. A record disappearing from this recent view does not establish that its retention period has ended. This view is not a complete archive of your answers.
Credit archives are separate from decision metadata. Each private NDJSON file contains a single account's original ledger rows, including balances, request/model references and timestamps. The owner and authorized administrators can download verified records through authenticated routes that prohibit caching. Files are not public and have no automatic expiration; financial retention, backups and lawful deletion are managed separately. Deleting an account removes its archive listings, but does not by itself erase the stored archive files. Contact support about archive deletion rather than assuming it follows account deletion.
Information you copy, download, email, or save in another application is subject to that application's handling, not these replay periods.
Browser-local announcement preferences
Opening a homepage feature announcement stores its ID and a read flag in localStorage on that browser. Its entrance is then hidden, including on later visits and language changes; the open dialog stays available until you close it. The flag contains no account, API key, prompt or image data and is not sent to the service. New announcement IDs are independent. Clearing site storage removes the flag; if storage is unavailable, the notice can return on a later visit.
Protect your account and connections
Do not share email sign-in codes. If you use an API connection, create the key in your own account console and keep it in a trusted private connection setting—not in a public document, shared screenshot, model prompt, or browser page source.
Revoke a key in the console if it is exposed or no longer needed. Use a new key for a replacement connection. Revoking a key prevents future use of that key; it does not retract content already submitted or delete past records.
When sharing errors or results with a colleague or support, review them for sensitive text first. Do not assume that every sensitive value will be automatically removed. Include the request ID, approximate time, and a short issue description rather than a full customer conversation whenever possible.
Privacy questions
For questions about sensitive submissions, retention, or account records, contact support@system-one.dev. Do not send credentials or unnecessary personal data with your request.
Credits and billing explains usage records and uncertain charges; Use results in workflows explains review and permissions.