What is true about our security and retention.

Data handling

Prompts are not used for training. Response bodies may be cached for up to 300 seconds for non-ZDR requests. A ZDR request disables that cache. Upstream retention varies by provider; the model page lists the provider.

• Prompts: not used for model training.
• Response cache: up to 300 seconds for non-ZDR requests, account-scoped, disabled when ZDR is requested.
• Usage logs: model, tokens, cost, request id, latency and fallback metadata. No prompt body.
• Dev capture: off by default, gated by an environment flag and key allowlist, and refused for ZDR requests.
• Upstream providers: retention varies. Each model page lists the provider and the applicable note.

Service levels

No contractual SLA is offered on the self-serve plan. Uptime and incidents are published on the status page. Enterprise terms are separate.

• Status: /status and /v1/health-history.
• Usage: /usage.json.
• Self-serve SLA: none. The terms say so.
• Enterprise terms: separate, and only when signed.

Accounts

• Disposable-domain and MX/A checks
• Per-IP and per-domain signup limits
• 12-character password minimum
• 24-hour JWTs with revocation
• Login throttling and lockout

API keys

• Hashed at rest
• Maximum 10 active keys per account
• Revocable individually
• Scoped agent tokens
• Per-account concurrency caps

Payments

• Paystack HMAC verification
• Idempotent transaction status
• Constant-time signature comparison
• Referral reward caps
• Paystack checkout is unchanged

Webhooks

• Paystack HMAC
• QStash signature verification
• Resend/Svix inbound and bounce signatures
• Unsigned inbound rejected when a secret is set

Headers and logs

• HSTS, CSP, Permissions-Policy
• COOP/CORP, nosniff, frame DENY
• Secrets and emails redacted
• Request metadata only

Admin

• Optional IP allowlist
• Separate JWT role check
• No admin MFA yet
• No hardware-key enforcement yet

SOC 2

Not certified. A SOC 2 program is not claimed as complete.

A trust page is not a certificate. Do not treat this page as one.

Data residency

Fikra runs on cloud infrastructure and routes to third-party inference providers. Region depends on the model and provider.

EU or US in-region routing is not offered today. Confirm the provider and region for your workload before committing.