Privacy

What Zorbe collects, where it stores it, and what we never do with it. Last updated: this document evolves with the product.

What we collect

When you sign up for Zorbe we collect the minimum needed to give you an account:

• Your email address.
• A bcrypt hash of your password (never the password itself).
• The organization name you provided.
• Optional profile fields you may add later: display name, title, phone number, avatar color.

When you send traffic through the Zorbe gateway we record per-request metadata in an append-only audit log on your deployment: timestamp, model selected, tokens in/out, cost, the optimisation decisions Zorbe made (cache hit, tier substitution, cascade outcome). The prompt and completion themselves are stored only when your tenant's policy enables prompt retention; the default is metadata-only.

Where it's stored

Customer data lives in a single PostgreSQL database on the infrastructure where Zorbe is deployed. For self-hosted deployments that means your servers, your cloud account, your perimeter. Zorbe does not phone home; the gateway has no inbound or outbound connection to any Zorbe-controlled service.

Stored credentials for upstream providers (e.g. OpenAI, Anthropic API keys you give to Zorbe so it can call those services on your behalf) are envelope-encrypted at rest using a master key set by the operator at deploy time. The plaintext only exists in memory during a request.

What we forward to LLM providers

When you send a chat or embedding request, Zorbe forwards the prompt to the upstream provider you selected (OpenAI, Anthropic, Google, etc.). That provider receives the prompt and your account identifier with them, governed by their terms. Zorbe does not add any data to the request you didn't send; we do not enrich prompts with cross-customer data.

If you configure a self-hosted model (vLLM, Ollama, TGI), prompts never leave your network.

What we never do

• We never sell or rent your data to third parties.
• We never train models on your prompts or completions without your explicit configuration.
• We never cross customer boundaries: one tenant's data is never used to serve another tenant's requests.
• We never log API key plaintexts. Keys are HMAC-hashed at issue time and the plaintext is shown to you exactly once.

How we protect it

• TLS in transit (Caddy with Let's Encrypt or your corporate CA).
• Strict HTTP security headers (HSTS, CSP, X-Frame-Options DENY, Referrer-Policy, Permissions-Policy).
• Envelope-encrypted credentials at rest; master key never on disk in plaintext.
• Bcrypt password hashing; structured logging with automatic redaction of any token shape that leaks into a log field.
• Per-tenant, per-workload, per-key rate limits; circuit breakers on every route to prevent runaway upstream costs.
• Tamper-evident audit log with periodic ed25519-signed anchors.

Your control

You can delete your account and your organization at any time from the dashboard. Deletion removes your user row, the org row, the encrypted credentials, and the issued API keys. The audit-log rows tied to your tenant are retained for the period your deployment's retention policy specifies (default: kept until the operator deletes the database).

Contact

For privacy questions or deletion requests, contact your Zorbe operator. If you are self-hosting Zorbe, you are the operator; configure a contact address in the application settings and surface it here.