A clear breakdown of what data Standard Compute collects, what it does not collect, how long it is kept, and your rights over it.
Standard Compute uses third-party infrastructure and model providers to process requests. The providers used depend on the selected model, availability and your settings. We do not use your prompts or responses to train models.
Use Compliance in your dashboard to set a region rule for your personal keys, or for a company, a team or a single key. Rules are opt-in: keys without one can be served by providers anywhere.
Selecting Europe, the United States, or both restricts model-provider inference to the selected regions, including provider fallbacks and the classifier that chooses a model. If no eligible route is available, the request fails. Provider headquarters are not used as a substitute for inference location. The approved endpoint list uses the provider-location research in our provider directory. Routing infrastructure may process traffic outside your selected regions. These controls are not end-to-end data residency.
A region rule also requires no training and zero data retention, which cannot be switched off while the rule applies. Restricted requests only go to eligible provider endpoints and disable response storage. Keys without a rule do not carry these provider requirements; each provider’s own terms apply. Temporary provider prompt caches can still fall within a provider’s zero data retention policy. Account, billing, security and usage metadata are retained to operate the service.
These protections apply to model-provider requests. End-to-end zero data retention across all routing infrastructure has not yet been confirmed.
Choosing fewer regions can exclude models and lower-cost providers. Your plan price stays the same, but the compute budget may be used faster. Company admins set a rule that covers every company key, including future keys, and can narrow it for a team or a single key; personal keys have a separate rule. Changes apply to new requests, while requests already in progress retain the policy they started with.
Standard Compute stores the minimum data necessary to operate the service. This includes your email address (used for authentication and account communications), encrypted API keys and their corresponding HMAC hashes, basic account metadata such as your plan type and subscription status, and usage counters that track request volume and token consumption at the account level.
We also store timestamps for account creation, last login, API key creation, and last API key usage. These timestamps support security auditing and fair-use enforcement.
We do not store, log, or retain the content of prompts you send to the API or the responses generated by upstream LLM providers. Prompt and response payloads pass through our routing layer in memory and are discarded as soon as the response is delivered to your client.
We do not store IP addresses beyond the duration of a single request. We do not build advertising profiles, track your browsing across third-party sites, or maintain any form of advertising identifier.
Our marketing website and dashboard do use Google Analytics (loaded via Google Tag Manager) for aggregate traffic and conversion statistics; it sets first-party analytics cookies (such as _ga). We also set one first-party cookie recording which page and referrer first brought you to the site, so we know which channels work. Neither is used for advertising or shared with data brokers — and none of it touches API traffic: prompts and responses are never logged, analytics or otherwise.
Account data (email, encrypted keys, plan information) is retained for as long as your account is active. If you delete your account, all associated data is permanently removed from our primary database within 24 hours.
Automated database backups may retain deleted data for up to 30 days after account deletion. After that window, the data is purged from all backup systems.
Aggregated, anonymised usage statistics (for example, total platform request volume per day) are retained indefinitely for capacity planning. These statistics cannot be linked back to any individual account.
You can delete your account and all associated data at any time from the Dashboard under Settings > Account > Delete Account. This action is immediate and irreversible — all API keys are invalidated, all usage data is removed, and any active subscription is cancelled.
If you prefer a targeted deletion — for example, revoking a single API key without closing your account — you can do so from the API Keys section of the Dashboard. Revoked keys are cryptographically invalidated and their encrypted material is deleted within 24 hours.
If you need assistance with a data deletion request or want to verify that deletion has been completed, contact us at contact@standardcompute.com.
Standard Compute processes personal data (your email address and account metadata) as a data controller under the General Data Protection Regulation (GDPR). Our lawful basis for processing is contractual necessity — we need your email to create your account and deliver the service you signed up for.
You have the right to access your data, rectify inaccuracies, request erasure, restrict processing, and receive your data in a portable format. All of these rights can be exercised from the Dashboard or by emailing contact@standardcompute.com. We respond to data subject requests within 30 days.
Your account data (email, encrypted API keys, account metadata) is held within the European Economic Area via our EU-based infrastructure sub-processors. Prompt content is a different case: it is forwarded to upstream model providers, some of which are based and process data outside the EEA. We do not represent that prompt content remains within the EEA or is covered by EEA-equivalent legal safeguards once it reaches those providers.
Supabase — provides authentication, database hosting, and row-level security enforcement. Supabase processes your email address and stores your encrypted API keys on our behalf. Supabase's infrastructure runs on AWS in the EU (eu-central-1) for our deployment.
Upstream model providers receive prompt payloads and return model responses. For keys under a Compliance region rule, routing requires provider endpoints in the selected regions with no-training and zero data retention policies. Provider policies can permit temporary prompt caches. Keys without a rule use standard routing under each provider's own terms, and inference may run outside the EEA and the US.
Stripe — processes subscription payments. Stripe receives your email address and payment method details. Standard Compute does not store credit card numbers or bank account information.
If we add a new sub-processor, we will update this page and notify active accounts via email at least 14 days before the new sub-processor begins processing data.