What is retained
ModelRiver stores the following data for every processed request:
| Data type | Purpose | Retention |
|---|---|---|
| Request payloads | Debugging and auditing | Your plan's retention period, if the project saves full request and response text |
| AI responses | Observability and auditing | Your plan's retention period, if the project saves full request and response text |
| Token usage, model, status, and cost per request | Cost analytics and billing | Your plan's retention period |
| Daily and monthly usage totals (requests, sessions, tokens, cost) | Usage history and billing | While your account is active; no prompt or response content |
| Cached responses | Response caching | Until the request they came from is deleted |
| Cache fields | Customer data echo | Not stored separately; they are part of the request payload |
| Webhook and callback delivery logs | Delivery status tracking | Until deleted, including the payloads sent and the responses received |
| Timeline events | Request lifecycle tracing | Tied to request |
Request logs are kept for at least your plan's retention period: 30 days on Free, 60 days on Pro, 90 days on Scale, and 180 days on custom and higher plans. They may be deleted after that. Logs still needed for your current billing period are kept until it closes. Usage totals are saved before logs are deleted, so the console still shows past usage. There is no per-project retention setting.
Organization audit log
The organization audit log records team activity such as sign-ins, role changes, and API key changes. It is recorded for every organization on every plan, separately from request logs:
| Data | Retention |
|---|---|
| Audit log entries | 12 months (24 months on Custom plans) |
| IP address and browser (user agent) on each entry | Cleared after 90 days; the rest of the entry is kept |
Audit log entries never contain API keys, passwords, prompts, or AI responses.
Managing what is stored
- Stop saving full request and response text: In Project settings → Request logs, turn off Save full request and response text. New logs then keep only basics such as the model used, status, and token counts. This setting can't be turned off while any workflow in the project has session memory enabled, because session memory relies on the stored text. It does not change logs that were already saved, and webhook and callback delivery logs still record the payloads they send and receive.
- Delete existing data: Contact support to delete logs for a project or a specific scope (see Deletion requests).
- Selective caching: Use cache fields selectively and redact sensitive data before sending to ModelRiver.
Data minimisation
Best practices for minimising data exposure:
- Avoid logging PII: Strip personally identifiable information from request payloads before sending.
- Use cache fields selectively: Only cache the business identifiers you need for observability.
- Redact before sending: Process sensitive content on your side before including it in AI requests.
- Separate environments: Use distinct projects for development, staging, and production to isolate data.
Deletion requests
To request data deletion:
- Email [email protected] with your project name and the scope of deletion
- Include specific date ranges or request IDs if applicable
- Deletion is processed within 7 business days
- You'll receive confirmation once complete
Next steps
- Input guardrails: Gateway content policy enforcement
- Compliance: Audit trails and regulatory considerations
- API keys: Manage authentication credentials
- Observability: Monitor request data and usage