# An AI model's privacy promise may not cover your proxy

Your prompt passes through more than one business. Check the gateway, the upstream provider and any connected tools.

[Canonical HTML page](https://nosecrets.app/en/stories/ai-proxy-privacy-more-than-model-policy)

Published by: [No Secrets Research](https://nosecrets.app/en/about#methodology)
Added: 2026-10-20
Topic: Technology

## Scope and context

Applies to: Third-party AI gateways and their upstream providers
Time context: Policies checked October 20, 2026
Sources checked: 2026-10-20

OpenRouter is used for its published distinctions, not accused of selling prompts. Other services require their own policy review.

## The gateway has its own policy

OpenRouter says prompt/response storage is off by default unless relevant logging or data-use options are enabled; it separately retains request metadata. That distinction shows why 'no training' should not be treated as a blanket promise of no records.

[1: OpenRouter](https://openrouter.ai/docs/guides/privacy/data-collection)

## The upstream is another layer

Its provider-logging page explains that model suppliers have separate policies, with training preferences distinct from the gateway's own policy. Third-party tools and plugins may introduce additional services. One company's policy cannot establish what every participant does.

[2: OpenRouter](https://openrouter.ai/docs/guides/privacy/provider-logging)

## Questions before sending sensitive work

Our checklist: who receives the text, who can inspect logs, how long records remain, and what changes during fallback? Test with redacted material until those answers are clear. A privacy badge or the original model vendor's logo does not answer these questions.

[1: OpenRouter](https://openrouter.ai/docs/guides/privacy/data-collection) · [2: OpenRouter](https://openrouter.ai/docs/guides/privacy/provider-logging)

## Sources

1. [Data Collection](https://openrouter.ai/docs/guides/privacy/data-collection) — OpenRouter. . Gateway's own content logging options and metadata collection.

2. [Provider Logging](https://openrouter.ai/docs/guides/privacy/provider-logging) — OpenRouter. . Upstream providers have separate retention and training policies.

## Disclosure

AI-assisted research, writing and translation by No Secrets, using the linked public documents. This is a source summary, not firsthand reporting or an independently audited investigation. No affiliate links are used in this article.

The source-check date is not the event date. Original documents control if a summary differs.