Data handling
The lifecycle of a request's data — what exists during processing, what is retained afterward, and who processes what.
This page follows one request through the system and accounts for every piece of data it creates. The operational summary is on the privacy page; the legally binding policy is at /legal/privacy.
During a request
While a request is in flight, its content necessarily exists in memory at two places: the gateway (to forward it and hash it) and the Azure fleet (to run the model). Both are transient. The gateway computes SHA-256 hashes of the exact request and response bytes for the receipt; under the Azure data-processing terms, Microsoft processes content to serve the call, does not retain it, and does not use it for training.
On the Responses API, OpenAI and Azure default store to true, which would persist content upstream for 30 days. Draftworks forces the default to false; server-side state exists only if you opt in per request.
After a request
What remains, per request:
| Data | Where | Why | Retention |
|---|---|---|---|
prompt_sha256, response_sha256 | Receipt store | The signed receipt commits to content without containing it | Indefinite, receipts are permanent |
| Token counts (input, cached, output, reasoning) | Usage ledger | Billing and your usage dashboards | Indefinite |
| Request metadata: timestamp, endpoint, model id, key id, latency, status code | Usage ledger | Billing, debugging, abuse prevention | Indefinite |
| Billed and list cost | Usage ledger | The credit ledger and your savings figures | Indefinite |
A hash commits to content without revealing it: given prompt_sha256 alone, the prompt cannot be reconstructed; given the prompt, anyone can verify the hash. That asymmetry is what lets receipts exist without content retention.
Account data
| Data | Why | Retention |
|---|---|---|
| Email, name | Sign-in and account recovery | Life of the account |
| API keys | Stored as SHA-256 hashes only | Until you delete the key |
| Credit ledger and purchase history | Prepaid billing | Life of the account |
Closing your account from /dashboard/settings deletes it immediately; remaining balance is forfeited, as the flow warns. Signed receipts are content-free and remain retrievable by request id, which is what makes them useful as permanent evidence.
Who processes what
| Subprocessor | Role | Sees content |
|---|---|---|
| Microsoft Azure | Model inference | Transiently, to run the model |
| Vercel | Gateway and hosting | Transit only |
| Convex | Ledger: hashes, counts, metadata | No |
| Stripe | Payments | No |
For a data processing agreement or any privacy request, contact privacy@draftworks.dev. The full subprocessor list and change-notification procedure are in the legal policy.