Privacy And Data Routing

Serious work runs through Alfrada OS — client contracts, financial models, medical images, personal plans. So the first question deserves a straight answer: when you send a message, where does it actually go, and what does the company running the model get to keep?

The short version: Zero Data Retention (ZDR) means the company running the model deletes your prompt and its answer as soon as the response is produced — nothing is stored, and nothing is used for training. Alfrada OS enforces ZDR wherever it is available, switches you to a zero-retention stand-in automatically when a ZDR route disappears, and gives you an EU-only mode when your work has to stay in Europe. This page explains each of those pieces in plain language.

Keep everything in the EU

Turn on EU Data Residency.

Works in one message from any chat — the agent flips the setting for you, no settings page needed.

Pick an EU-hosted model for sensitive work

Switch this session to an EU-hosted model before we go through this contract, and tell me which one you picked.

Ask before you paste

Before I share this document: where does the current model run, and what does its provider retain?

Where Your Chats Actually Run

Alfrada's models run in two ways:

• Directly with first-party providers — OpenAI, Anthropic, Amazon Bedrock, Google, Alibaba (its EU Model Studio service), and Z.ai.
• Through OpenRouter — a routing marketplace that places each request with one of several hosting companies running that model.

The marketplace is where retention could get murky, so Alfrada OS doesn't leave it to chance: every live OpenRouter model is pinned to Zero Data Retention endpoints that also support tools. In plain terms, each request tells OpenRouter it may only use hosts that promise to keep nothing — and that can actually run the agent's tools, because a host that can't call tools is useless for real work. A few hosts advertise ZDR but can't do tools, and those are skipped by name: DeepSeek V4 Flash skips Wafer, MiniMax M3 skips CoreWeave, and Kimi K3 skips DeepInfra, Parasail, and Phala. The exact request flags live in the appendix at the bottom of this page.

This has been the direction of travel for a while: DeepSeek V4 moved to zero-retention endpoints in April and the open-weight Qwen3.8 2.4T route shipped with ZDR enforced from day one; today the pin covers every OpenRouter model in the catalog.

One deliberate exception: Claude Fable 5 is the single non-ZDR model in the picker, and it says so right on its card — "the provider may retain inputs and outputs." Pick it for what it's uniquely good at, but keep sensitive data out of that one model.

If A ZDR Route Disappears, You Switch — You Don't Fail

ZDR hosting comes and goes; a host that was available this morning may be gone by lunch. When OpenRouter has no zero-retention, tool-capable host for your model, Alfrada OS does not quietly loosen the retention requirement, and it does not fail your turn. It switches that turn to the closest first-party stand-in and tells you with a short notice:

"Zero Data Retention endpoints are not available for [your model] right now. Switching to [the stand-in]."

— for example, "Zero Data Retention endpoints are not available for Kimi K3 right now. Switching to GPT-5.6 Sol."

How the stand-in is chosen: same capability tier as your model when possible, then in a fixed provider order — OpenAI, then Anthropic, then Amazon Bedrock, then Google, then Alibaba, then Z.ai. Claude Fable 5 is never chosen as a stand-in, precisely because it is the non-ZDR exception.

This safety net covers everything: your normal single-agent chat, the Swarm planner, and every Swarm worker. A multi-agent run keeps going on the stand-in rather than stalling or downgrading your privacy mid-flight.

Keeping Work In The EU

Every model in the picker carries a small residency dot and label so you can see where it runs at a glance:

• EU (blue) — an EU-hosted route, e.g. MiniMax M2.5 on Bedrock (London) or Qwen3.8 Max (Alibaba's eu-central-1 service in Germany).
• Global (grey) — the worldwide route for the same family, e.g. MiniMax M2.5 via OpenRouter — the picker shows both routes under the same name, told apart by the dot.
• CN (red) — a China-hosted route. The picker flags these loudly; the current public catalog has none.

If EU residency is a requirement rather than a preference, turn on EU Data Residency mode. The setting describes itself plainly: "Restrict all model selection to EU-hosted and local (Sovereign) models only. Global models (OpenAI, Google, OpenRouter) will be hidden."

To switch it on, ask the agent — say "Turn on EU Data Residency" in any chat.

While EU mode is on, the picker only offers EU-hosted models — and the ZDR safety net narrows to match: stand-ins are drawn only from Anthropic, Amazon Bedrock, and Alibaba's EU service, never from a hidden Global provider.

Work That Never Leaves The Machine

Two tools go further than ZDR — the data doesn't get deleted after processing because it never travels to an outside AI provider at all. They differ in which machine does the work, and that difference matters:

• Medical Vision reads X-rays, scans, and clinical documents on your own deployment. Nothing leaves it — no cloud provider ever sees the image. (Release note)
• Image Consistency compares generated images for character, object, and style drift using Gemma 4 12B running on Alfrada's own GPU server via Ollama. The images stay on that box — no external AI provider ever receives them — but the work happens on Alfrada's infrastructure, not yours. (Release note)

Video Generation Plays By Different Rules

Video providers are the one corner of the platform where zero retention isn't always on offer — so instead of pretending otherwise, every video result carries a data-policy tag naming what its provider actually keeps:

Provider	What they keep
Seedance (ByteDance)	Zero prompt retention
xAI	Prompts kept for 30 days; not used for training
MiniMax	Prompts kept for an unspecified duration; not used for training
Runway	Prompts kept for an unspecified duration; not used for training

None of them train on your prompts. But one caveat is always true, and the tag states it as a mechanism: "Video jobs temporarily keep the rendered MP4 for poll/download; Zero Data Retention cannot apply to video generation." You have to be able to download the clip you just made, so the finished file necessarily exists somewhere for a while. If a video prompt is sensitive, pick the provider accordingly — Seedance if retention is the concern.

What Alfrada OS Itself Stores

ZDR is about the model providers. Alfrada OS itself does store your conversations, files, and memories — in your account, so the agent can pick up last week's work, find an old file, and act like a colleague rather than a stranger in every session.

That storage is yours to manage:

• Secrets and credentials the agent uses live in the Vault.
• Nothing leaves your account unless you share it — and a shared conversation is scrubbed first (tool runs, system prompts, and memories are stripped).
• Deleting everything is Settings → Account → Vault tab → the Danger Zone at the bottom, where you can permanently delete your account.

For which model to pick in the first place — bands, labels, Auto — see Models And Modes.

For The Curious

Appendix: identifiers

• models.json fields: zdr: true marks a model as ZDR-pinned; zdr_ignore_providers lists the no-tools ZDR hosts skipped for that model (e.g. ["wafer"] on DeepSeek V4 Flash, ["coreweave"] on MiniMax M3, ["deepinfra", "parasail", "phala"] on Kimi K3); residency carries the picker label (EU / Global; GPU and CN are derived).
• OpenRouter request flags: provider.zdr: true and provider.data_collection: "deny" on every OpenRouter call; skipped hosts go in provider.ignore.
• Fallback provider order: openai → anthropic → bedrock → google_genai → dashscope → z_ai; EU-only mode restricts the pool to {anthropic, bedrock, dashscope}; model paths containing fable are excluded.
• Settings: the EU toggle is the eu_only user setting (the agent can set it via the settings tool).
• Video data-policy tag: data_policy on video results, with retains_prompts, retention_days, trains, and async_output_note fields.