Last reviewed: October 24, 2026
This page summarizes how ModelRiver protects your data. For the contractual commitments, see our Data Processing Agreement and Subprocessors. For security questionnaires or questions, email [email protected].
Infrastructure
- ModelRiver runs on Amazon Web Services in the United States (us-east-1), with a managed PostgreSQL database (Amazon RDS).
- All web and API traffic goes through Cloudflare, which provides TLS, DDoS protection and filtering before requests reach our servers.
- Database credentials are kept in AWS Secrets Manager, not in code.
Encryption
- In transit: every connection uses HTTPS; plain HTTP is redirected. Connections from our application to the database use TLS with the database's certificate and hostname verified.
- Provider API keys: the keys you add for OpenAI, Anthropic and other providers are encrypted in our database with AES-256-GCM, and are never shown again after you save them.
- ModelRiver API keys: we store only a SHA-256 hash. The full key is shown once, when you create it.
- Passwords: hashed with bcrypt. Two-factor secrets are encrypted at rest.
Access control
- Two-factor authentication (authenticator app, TOTP) is available for every account, including accounts that sign in with Google or GitHub.
- Roles: organizations have owners, admins, editors and viewers. Only owners manage billing and members; viewers can't change anything.
- Tenant isolation: every project, workflow, key and log belongs to one organization and project, and every request is checked against the caller's organization and project before any data is read or changed.
- Web console protections: sessions use secure, SameSite cookies, and state-changing requests require a CSRF token.
Application security
- Rate limiting per project and per client IP, with limits set by plan.
- Outbound request protection: requests to URLs you configure (custom providers, webhooks, callbacks) are blocked from reaching private or internal network addresses.
- Signed webhooks: every webhook carries an HMAC-SHA256 signature over the payload and a timestamp, so your server can verify it came from ModelRiver.
- Payments are handled by Stripe Checkout; card details never reach our servers.
- Guardrails: prompts can be checked for harmful content before they reach a provider, configurable per project.
Your data
- You control what is logged: each project can turn off saving full request and response text.
- Retention: request logs are deleted after your plan's retention period (30 days on Free, 60 on Pro, 90 on Scale, 180 on custom plans). Daily and monthly usage totals, which contain no prompt or response content, are kept so you can still see past usage.
- Deletion: on request, we delete your account and its data within 30 days. Email [email protected] from the account's address.
- No training: we don't use your requests or responses to train AI models.
Reliability
- Status page: live service status and uptime history at status.modelriver.com.
- Uptime target: 99.9% monthly for paid plans.
- Backups: the database is backed up daily, each backup is checked after it's written, and restores are tested regularly.
- Deploys are scripted, with an automatic switch back to the previous version if a new release fails its health check.
- Error monitoring alerts us to crashes and failed jobs. Customer data is removed from these reports before they leave our servers.
Incident response
If we become aware of a security incident affecting your personal data, we will notify the affected organization owners without undue delay, and within 72 hours, with what we know and what we're doing about it. Service incidents are posted on our status page.
Reporting a vulnerability
If you think you've found a security issue, email [email protected] with the details and steps to reproduce. Please give us reasonable time to fix it before sharing it publicly. We don't take legal action against good-faith research that avoids accessing other customers' data and doesn't disrupt the service.
Compliance
- Data processing: our Data Processing Agreement covers GDPR, UK GDPR and CCPA requirements, including Standard Contractual Clauses for international transfers.
- Certifications: we don't hold a SOC 2 or ISO 27001 certification yet. We're happy to answer security questionnaires and walk your team through our controls.
Last updated: October 24, 2026