Data Usage
Last Updated: 10 July 2026
The honest walkthrough: what the product processes on every call, what it stores, and what it will never do. It starts with the thing the whole pipeline exists to produce — an evidence record.
- model
- claude-sonnet-5
- route
- Cheapest Compliant
- dataClass
- Internal
- dpia
- Not Triggered
- residency
- EU-Preferred · Passed
- policy
- Passed
- costBilled
- $0.0142 · Exact
- promptHash
- sha256:9f3c…4a1
- responseHash
- sha256:22b7…0c4
- approval
- Not Required
Enough to prove the decision — the model, the route, the data class, the policy result, the exact cost, the hashes. None of your raw content.
Why Does A Governance Layer Need To See Your Data?
Because a request that cannot be read cannot be classified, gated or routed. That is the deliberate engineering trade LLM Vault is built around, so the pipeline is designed to see the minimum, keep the minimum, and prove the maximum. The rule that makes it safe — verify everything, trust nothing — is the Securitypage’s whole subject.
What Happens To Every Call?
The same eight steps, in the same order, with no exceptions. This is the life of a governed request:
Arrival & Verification
The platform reads and classifies the payload for itself the moment it arrives — the sender’s description of it is treated as a claim, not a fact.
Data Classification
Content is graded from Public to Restricted, so sensitive material is recognised before any other decision is made.
DPIA Triage
Personal or regulated data automatically queues a Data Protection Impact Assessment.
Residency & Jurisdiction Check
The request is tested against workspace policy — for example “EU-Preferred” — before any routing decision exists.
Data-Risk Gate
If real data risk cannot be resolved, the gate fails Closed and the call stops here. Convenience features are the opposite — they fail Open and never block your work.
Routing
The call runs under your policy, on your own provider keys.
Exact Cost
The billed cost is recorded to the cent — never an estimate presented as fact.
Evidence Minted
The evidence record above is written, hashed, and added to the audit log.
What Does BYOK Mean For Your Data And Your Bill?
Bring Your Own Keys: you call model providers on your own keys, encrypted at rest, under your own provider relationships. LLM Vault is a control plane over those relationships, not a reseller between you and the price — which is also why the cost intelligence can be blunt: exact billed cost per call, subscription-versus-API reconciliation, and token-waste analysis that shows where context was re-sent for nothing.
What We Never Do
No Token Markup
You pay providers what providers charge. We add nothing to the token price.
No Training On Your Content
Your prompts, records and content never train a model — ours or anyone else’s. What improves the platform is anonymised telemetry: content-derived metadata such as risk classifications, data classes and routing outcomes — a description of the request, never the request itself.
No Sale Of Customer Data
Your data is not a product. It is never sold or shared for value.
No Secret Retention
Secrets and credentials are redacted before storage and never stored in any form.
No Cross-Workspace Visibility
One workspace can never see another’s data, policies or audit trail.
Where Does Data Live?
The primary data store is hosted in the EU (eu-west-1), and residency policy governs where data may be stored and processed on a per-call basis — jurisdiction is checked every time, not assumed once at setup. Who can see what inside a workspace is an access question, answered on Security; how little of it we keep in the first place is answered on Privacy.
What About The Coach Agent On Developer Machines?
The AI Builder Coach reads coding sessions locally and sends summaries for governance — and those summaries go through the same eight steps above, like any other payload. When it may look, and at what history, is a consent question you control, covered on Privacy.