01The data boundary
Anyray is self-hosted, so prompt and response content never leaves your environment. The gateway, console, optimizer, and Postgres all run on your infrastructure. The only data that egresses is the content-free usage rollup each deployment sends to Anyray Portal for metering — counts and aggregates, never content.
Two guarantees hold regardless of how you configure the system:
- Content stays in your environment. Prompt and response content is never sent to Anyray.
- Spend and logs are content-free. The spend store and request logs record who/team, model, provider, tokens, cost, and latency — never content.
02What is stored — and what is not
Every store below lives on your volumes and datastores; the sole exception is the Portal account plane, which never holds prompt or response content — only account, usage, and billing metadata.
| Store | Class | What it holds | Location |
|---|---|---|---|
| Spend store | Internal | Per-request metadata: user/team, model, provider, tokens, cost, latency. Never content. | Your Postgres anyray_spend |
| Observability traces | Confidential | Attribution + token/cost/latency metadata; content only per the content mode (ciphertext in encrypted, none in off). | Your Postgres |
| Client keys & enrollment links | Internal | Usernames bound to records — token hashes only (SHA-256), never raw values. | Gateway data volume |
| Optimizer ephemeral stores | Confidential | Semantic-cache and externalized originals, in memory only, TTL-bounded, lost on restart. Keyed by content-free hashes. | Optimizer process memory |
| Audit logs | Internal | Per-domain append-only records: actor + action + timestamps. Metadata only. | Gateway / optimizer volume |
| Anyray Portal account plane | Pseudonymous | Operator sign-in, tenant memberships, content-free usage rollups, pseudonymous seat hashes, and billing data (processed by Stripe — see Subprocessors). | Vendor control plane |
03Encryption
- At rest. In the default
encryptedmode, content is encrypted with AES-256-GCM before it ever touches disk. This layer fails closed — it never falls back to writing plaintext. - Content mode. One org-wide setting decides how much content is kept:
encrypted(default),off(store nothing), orplaintext(deploy-gated, for intentional debugging only). Every change is audit-logged with the actor and before/after value. - In transit. The gateway is served behind TLS at the edge — see Security.
- Portal account plane. Runs on a dedicated AWS backend in the EU (Frankfurt) — private-subnet compute behind a web application firewall, encrypted in transit (TLS 1.2/1.3) and at rest (AES-256, AWS KMS).
Content privacy doesn't rest on a single switch: six independent layers each enforce it, so a misconfiguration in one does not expose content. The full mechanics are documented at docs.anyray.ai/operate/data-boundary.
04What leaves your environment
The only egress is the content-free usage rollup to Anyray Portal, for metering. By default it carries:
- a distinct active seat count plus opaque seat hashes — pseudonyms, not reversible without your per-deployment salt, which never leaves your environment; and
- usage totals (requests, tokens, cost, month-to-date savings) with per-model / per-provider buckets.
A per-user breakdown is opt-in and stays content-free (counts and dollars only — never content). Left unset, the rollup is fully pseudonymized.
05Data-subject rights
The gateway exposes admin-gated endpoints so you, as controller, can serve data-subject requests. Each call is itself audit-logged, so access to personal data leaves a trail.
- Erasure (GDPR Art. 17) — removes a user's spend rows, client keys, and enrollment links, returning per-store counts.
- Access & portability (GDPR Art. 20) — exports everything the gateway holds for a user as JSON (metadata only — content fields stripped).
The operational detail — exact endpoints, the manual trace-deletion step — is documented at docs.anyray.ai/operate/compliance.
06Retention
Storage limitation is per store. Only the spend window is a knob you set directly; the rest are fixed defaults or owned by the datastore you run.
- Spend store — configurable retention window; unset keeps rows indefinitely.
- Optimizer cache / externalized originals — fixed in-memory TTL, lost on restart.
- Observability traces — in your Postgres; you prune or set a retention job, sized in your DPIA.
- Audit logs — append-only on the data volume; rotate/archive with your log tooling.
- Portal plane — control-plane retention tiers; sessions expire and invites are pruned.
07Contact
Email: hi@anyray.ai