Trust.
What happens to your data, which controls exist and which terms apply. The plain-language version of the data side is on the Privacy page.
The path of one request
Your application sends the request over TLS, with your key.
Each key carries its own budget and rate limits.
AVELIN receives it in one of its processing regions.
Cloud inference runs across the United States, Europe and MENA. Prompt and answer content is not stored in normal operation.
A model answers it.
An AVELIN model, by task and tier, picked by you or by the Decision Layer.
The answer returns the same way.
AVELIN keeps metadata to bill you and keep the service secure. Learning on your content is off unless you turn it on.
Your data
Prompts and answers.
Zero retention by default in AVELIN Cloud. They are not used to improve AVELIN unless you opt in, and you can withdraw consent at any time.
Records we keep.
Metadata to bill you and keep the service secure: timestamps, the model used, token counts, speed, status codes and your API key. Security and network logs, which include IP addresses, are kept for a limited time that the data policy states.
Where requests run.
AVELIN Cloud serves requests across the United States, Europe and MENA. The data policy lists the exact countries. Customers with data-residency requirements can ask about pinning to one region.
Your own providers.
If you connect your own providers to the Decision Layer, their terms apply to what they receive.
Subprocessors.
Infrastructure subprocessors are bound by data processing agreements. A current list is available on request.
Security and access
- Bearer-token API keys, with a budget and rate limits on each key.
- TLS on the API and on the web console.
- Usage records per key, with budget alerts.
- Encryption at rest for stored metadata, role-based access controls and network isolation between serving environments, as the API privacy policy states.
Terms
API use.
The API terms of service apply. Where you sign a separate agreement, such as a data processing agreement, it controls over the standard terms. The terms are governed by the laws of the United Arab Emirates.
POC.
A written scope for each engagement, with an NDA first if you ask for one. The scope says which terms apply. Nothing starts until you accept it.
Enterprise and private deployment.
A data processing agreement, a service level, indemnity and governing law are set in the written scope.
Questions
Send data-handling and security questions, or a security questionnaire, to hello@avelin.ai, or with your POC request. To report a security vulnerability, write to the same address with “Vulnerability” in the subject.
AVELIN AI. Addresses are on the Contact page.
Questions about trust
Does AVELIN store my prompts?
In AVELIN Cloud, zero retention is the default: prompts and answers are not stored in normal operation. The data policy lists the narrow exceptions and the periods that apply.
Does AVELIN train on my prompts?
No, not by default. Your prompts are used to improve AVELIN only if you turn on sharing, and you can turn it off at any time.
Does AVELIN hold SOC 2, HIPAA or ISO certification?
No. AVELIN does not hold SOC 2, HIPAA or ISO certification today and does not claim them. For a security review, use the data policy, the API terms and a security questionnaire, which you can send to hello@avelin.ai or with your POC request.
Where are requests processed?
AVELIN Cloud serves requests across the United States, Europe and MENA. The data policy lists the exact countries. If your data must stay in one country or region, say so in your POC request, and the scope names where it is processed before any data is sent.
Where do I send a security questionnaire?
To hello@avelin.ai, or with your POC request.
Bring your review questions.
Send your security questionnaire with a POC request, and the written scope answers it before any data is sent.