Data handling
What Atlas retains, for how long, and what it never does with your content.
This page is written to be checkable rather than reassuring. Each claim names the control that makes it true.
The short version
Prompts
Traced. Every request is recorded in Langfuse for debugging.
Completions
Traced. Including any reasoning prelude and tool calls.
Training
Never. Customer content is not used to train models.
What is retained
| Data | Retained? | For how long |
|---|---|---|
| Prompt content — messages, tools, parameters | Yes, in Langfuse | Langfuse project retention setting |
| Completion content, including a reasoning prelude and tool calls | Yes, in Langfuse | Langfuse project retention setting |
| Prompt or completion content in an Atlas database | No | — |
| Request id, organization, model, token counts, timings, outcome | Yes | Indefinitely |
| Account records — organizations, users, memberships, roles | Yes | Life of the account |
| API key hashes, prefixes, labels, last-used timestamps | Yes | Until revoked and pruned |
| Audit log — operator actions, membership and role changes | Yes | Indefinitely, append-only |
| Logs, metrics, traces | Yes | Per operator retention settings — allowlisted fields only, never content |
Request tracing
Every request Atlas serves is exported to Langfuse
Cloud as one trace: the request messages, tools and sampling parameters, the
assembled response, token usage, timings and outcome. Atlas uses these traces to
debug failures and quality issues — so a failing request can be investigated
from its request_id without you having to reproduce it.
- What is not exported: request headers, including your API key. The exporter never sees them.
- Who can read traces: Atlas operators with access to the Langfuse project.
- How long they last: the retention setting on Atlas's Langfuse project.
- Where content lives: in Langfuse only. No Atlas database table has a column that could hold prompt or completion content.
There is no per-organization opt-out yet, and no console toggle or API field for one. Ask your Atlas contact before sending content that must not be recorded by a third-party processor.
How content is kept out of logs
Tracing is the one path content takes out of the gateway. Everything else — logs, metrics, error reports and spans — never carries it. The control is a field allowlist at every boundary that can see a request body — not a denylist, because a denylist fails open on every field nobody thought of, and the fields nobody thinks of are the ones added next.
| Boundary | Control |
|---|---|
| Logger | Only allowlisted field names, and only values matching each field's declared kind. An unlisted field is dropped, and the drop is counted. |
| Log messages | Not free text — a constrained event name. An interpolated message becomes event.unnamed. |
| Error reporter | The report is constructed from allowlisted fields. error.message is never read; the stack's header line is stripped. |
| Metrics | Label names come from a low-cardinality subset; request_id is deliberately not a permitted label. |
| Traces | Span names and attributes go through the same two checks. |
Values are checked as well as names, because an allowlist over names alone still passes a prompt written into a permitted field.
Tenant isolation
Request and response content, and any server-side state derived from it — including prefix and KV caches — is scoped to a single organization. It is never shared with, or observable by, another.
This is enforced at the database level with row-level security scoped per transaction, not by application filtering, and there is an automated isolation suite that asserts it.
Infrastructure providers
Atlas requires every infrastructure provider in its serving path to be bound to the same no-retention default and the same no-training guarantee described here. That requirement is not yet met, and this is the honest status of it.
| Provider | Role | In the serving path | Sees content | Recorded terms |
|---|---|---|---|---|
| Inference backend host | Model execution | Yes | Every prompt and every completion | None recorded — open |
| RunPod | GPU infrastructure and the HTTPS proxy in front of the backend | Yes | Every prompt and completion in transit, and the host they run on | None recorded — open |
| Langfuse | Request tracing | No — exported after the response | Every prompt and every completion | None recorded — open |
| PostgreSQL host | Metering, accounts | Yes | No content | None recorded — open |
| Redis host | Admission-control counters | No | No content — counters keyed by organization and model | None recorded — open |
| WorkOS | Identity: users, organizations, memberships, sessions | No | No prompt or completion content; holds user records | None recorded — open |
The inference vendor sees every prompt and every completion. That is the normal path for every request, not an edge case.
No provider in the serving path has recorded data-processing terms yet — no zero-retention commitment and no no-training commitment is on file. That is an open item, not a passing state.
Nothing on this page should be read as an absolute guarantee about a third party Atlas does not operate. What Atlas can state is what it enforces on its own systems, and what it has bound its providers to in writing.
Ask your Atlas contact before sending production content you could not send to an unbound processor.
Credentials are never traced
Traces are built from the parsed request body and the response. Request headers
— authorization among them — are never handed to the exporter, so an API key
cannot reach Langfuse.
Audit
Operator actions, membership changes and role changes are recorded in an append-only audit log with the acting identity and a timestamp.
What this means for you
- Send the
request_idwhen you report a problem. It is the trace id in Langfuse, so Atlas can open the exact request and response. - Keep your own logs if your application needs a record of what it sent. Atlas is not that record.
request_idis the handle for everything else. Token counts, timings, outcome, model version, and cost are all retained and queryable against it.