Trust center
No-Log & Data Handling Policy
- No prompt, response, or file content logged
- Per-request records hold metadata and counts only
- Masked values encrypted, kept 30 days to restore responses
- Provider keys stored encrypted, never logged
What we never store. The text of prompts and completions, provider API keys in plain text, and your Maskflare API keys are never written to logs, traces, analytics, or the traffic record. Masking happens in memory while the request passes through.
What we record per request. Metadata needed to run the service and to show you what happened: organization and environment, provider, model, path, status, latency, token usage, and counts of how many values each rule matched, alerted on, or blocked. Counts never include the matched values.
The token vault. When a value is masked with a reversible token, the original value is stored encrypted so it can be restored in the AI provider's response. Each token expires after 30 days, can only be resolved by the API key whose traffic created it, and is never displayed in the console.
Files. When file scanning is enabled, attached files are analysed in isolated processes; a file sent for malware analysis is stored encrypted only for the retention period your organization sets. Metadata stripping and document text scanning keep nothing after the request.
Where it runs. Maskflare is hosted in the European Union. Data is not sold or used to train models.
Questions about data handling or sub-processors? See the Trust Center or contact us.