1. Data handling
We don’t store your content. Text, audio and transcripts pass through Allmodels to the provider you select and are returned directly to you. We don’t save, log or use them for any other purpose.
We retain only the information required to operate your account and bill for usage:
- Account information: your email address, organization, projects, members and API keys.
- Billing data: your credit balance and top-up history. Card details are held by Stripe and never reach our systems.
- Usage metadata: the model and provider used for each request, when it was made and what it cost.
2. Data processing and residency
Allmodels runs on Cloudflare’s global network, so requests are handled close to where they originate rather than in a single fixed region. Each request is then sent to the provider you select, which processes it under its own terms and data policies.
3. Subprocessors
| Subprocessor | Purpose |
|---|---|
| Cloudflare | Hosting, networking and request routing |
| Stripe | Payment processing |
| The AI provider you select | Fulfils your request. Providers are listed on each model page. |
4. Compliance
| Framework | Status |
|---|---|
| SOC 2 | In progress We’re targeting SOC 2 for Q1 2027. |
| GDPR | Supported The only personal data we hold is account and billing information. Request content passes through and is never stored. |
| Data Processing Agreement | Available Email security@allmodels.io to request one. |
5. Platform security
- Encryption in transit: all traffic to the Allmodels API is encrypted with TLS.
- API key protection: API keys are stored only as one-way hashes. A key is shown once when it’s created and can’t be read back by anyone, including us.
- Key revocation: revoke any API key instantly from the dashboard.
6. Access control
Allmodels supports organizations with multiple members and role-based access. Invite your team from Members in the dashboard and give each person a role:
- Owner: full control of the organization, including billing and deleting the organization.
- Admin: manages members, projects, API keys and guardrails, and can view billing.
- Member: read-only access to the organization’s projects, keys, usage and billing.
Every API key can also have a guardrail that caps its spend per hour, day or month and limits which providers it can use. See Spend limits.
Our recommendations. We recommend applying the principle of least privilege to secure your account:
- Keep the number of Owners to a minimum, and give Admin only to people who manage keys or members.
- Give everyone else the Member role.
- Use a separate API key and guardrail for each application and environment.
- Revoke keys that are no longer in use, and remove members who no longer need access.
7. Availability and incident response
We target 99.9% monthly uptime for the Allmodels API, and maintenance never affects production. Incidents are posted and updated on status.allmodels.io, where you can subscribe to notifications. Enterprise contracts include a contractual SLA. See Uptime and SLA.
8. Security contact
To report a vulnerability, request a DPA, or send a security questionnaire, email security@allmodels.io.