Security

We store token counts and discard your prompts.

Prompts and completions are processed in memory and aren't stored. Every key is pinned to one country, and every response tells your agent where it was served.Last updated October 11, 2026.

an inference response

x-st-region: us
x-st-data-retention: none
x-st-request-id: 01K5Z3T8R2V9Q4M6N1P7B0C8XD

The same facts as data: /security.json

01 · Data retention

Prompts and completions aren't stored.

This applies to every request. Each response carries x-st-data-retention: none so your agent can check it.

Prompts and completionsNot stored: Processed in memory to produce the response, then discarded. They aren't written to logs.
Batch and fine-tuning filesAt most 30 days: Stored encrypted in your region until you delete them or 30 days after upload, whichever comes first.
Fine-tuned modelsUntil you delete them: Private to your account.
Usage recordsLife of the account: Model, token counts, cost and timings, for billing. No content.

We don't use your prompts, completions or files to train models, except fine-tuning jobs you start for your own private model.

Check it on every response

x-st-region: us: The region that served the request. Every API response, errors included.
x-st-data-retention: none: Prompts and completions from this request are not stored. Every API response, errors included.
x-st-request-id: 01K5Z3T8R2V9Q4M6N1P7B0C8XD: The request's id, for usage records and support. Inference responses.

02 · Residency

One country per key.

A key starts with st_us_ or st_ca_, and that prefix decides where its requests are processed and its account data is stored. A key sent to the other country's API gets 421 wrong_region with the right base URL. Card payments for both regions are processed by Stripe in the US. The Privacy Policy says what else is processed outside an account's country. A current list of the companies that process data for us, with what each receives and where, is available on request. Write to privacy@scaledthought.com.

United States

Open

api.us.scaledthought.com

Canada

Coming soon

api.ca.scaledthought.com

a ca key sent to the US host

HTTP/1.1 421 Misdirected Request
x-st-region: us
x-st-data-retention: none

{"error": {"code": "wrong_region", "type": "invalid_request_error",
  "message": "This API key belongs to region \"ca\". Send requests to https://api.ca.scaledthought.com/v1",
  "base_url": "https://api.ca.scaledthought.com/v1"}}

03 · API keys

Scoped keys for each agent.

Give each agent the narrowest key that does the job, for no longer than it needs.

Hashed, shown once

We store only a hash of each key and show the key once, when it's created.

Expiry

Keys can expire after up to 365 days.

Rotation

Replace a key and keep the old one working for a grace period, so an agent can switch without downtime.

Self-revocation

A key that may have leaked can revoke itself, with no special permission needed.

Sub-agent keys

Give a sub-agent a narrower key that can never exceed its parent's scopes, budget or expiry.

Budgets and limits

Every key can have its own daily spending limit, rate limits and scopes.

CLI

# A sub-agent key: inference only, $2 a day, gone in 12 hours
npx -y scaledthought@0.3 keys create --name sub-agent --child \
  --scopes inference --budget-usd 2 --expires-in 12h

# Replace a key; the old one keeps working for 24 hours
npx -y scaledthought@0.3 keys rotate key_… --grace 24h

# This key may have leaked: revoke it
npx -y scaledthought@0.3 keys revoke-self

Reference: keys in the docs.

04 · Protection

How we protect your data.

Encryption: Traffic to our API uses TLS 1.2 or later. Stored data is encrypted at rest.
Separate regions: Each region runs as its own deployment, with its own database and keys.
Staff access: Staff sign in with passkeys, and every staff action on an account is recorded in an audit log.
Pinned models: Every model we host is pinned to an exact version, so what we serve can't change without us knowing.

05 · Incidents & reporting

If something goes wrong.

Incident response

If an incident affects your data or keys, we tell you at the account's email on file, if it has one. When many customers are affected, we also post a notice on this site and in /llms.txt. Regulators are notified as the law requires.

Report a vulnerability

Email security@scaledthought.com. We aim to acknowledge reports within 3 business days, and we won't take legal action over good-faith research that follows the policy. Scope and rules are in our vulnerability disclosure policy; the contact is also in security.txt.