Privacy Policy

1. Nature of the Gateway Service

Tanvelo acts as a high-performance proxy and routing plane between your applications and upstream LLM providers (including OpenAI, Anthropic Claude, Google Gemini, DeepSeek, Groq, Mistral AI, and self-hosted inference nodes like Ollama and vLLM).

When your application dispatches a request to POST /v1/chat/completions, Tanvelo inspects routing policies, verifies rate limits, and forwards the payload over secure TLS (HTTPS) to the selected provider.

2. In-Flight Inference Data & Zero Prompt Retention

By default, Tanvelo does not store or retain prompt payloads or model completion bodies in the database (LOG_PAYLOADS=false). In-flight streams are processed in transient RAM and piped directly back to the client application via Server-Sent Events (SSE) or chunked HTTP responses.

• Metadata Logging: Only operational execution metadata is logged (request ID, provider target, token counts, total latency, and HTTP status code).
• Payload Redaction: In environments where operator payload debugging is explicitly enabled, sensitive authorization headers (including Authorization, x-api-key) are permanently sanitized before write.
• No Data Sales: We do not sell, rent, or monetize your requests or completions.

3. Cryptographic Key Management

Upstream provider credentials (such as your OpenAI API Key or Anthropic secret) are stored encrypted in PostgreSQL using industry-standard AES-256-GCM authenticated encryption with unique initialization vectors and authentication tags verified prior to decryption.

Gateway API keys provided to your client applications are never stored in plaintext. We store only the one-way SHA-256 hash. Even in the event of an unauthorized database dump, raw gateway keys cannot be derived.

4. Third-Party Provider Disclosures

When Tanvelo routes a request to an upstream provider (e.g., Anthropic or OpenAI), the transmission of data to that provider is governed by that provider's respective privacy policy and enterprise data processing agreement (DPA). We encourage you to review their specific commercial terms:

5. Egress & SSRF Security Guardrails

To protect internal enterprise networks, Tanvelo webhooks and custom provider endpoints strictly enforce SSRF (Server-Side Request Forgery) egress protections. Destination IP addresses resolving to loopback (127.0.0.1), RFC1918 private subnets (10.0.0.0/8, 192.168.0.0/16), or cloud instance metadata services (169.254.169.254) are blocked by application-level egress security validation before network dispatch.

6. Compliance with GDPR & CCPA

Depending on your location, you may have rights under the European General Data Protection Regulation (GDPR) or the California Consumer Privacy Act (CCPA), including the right to request deletion of your project workspace metadata or exported analytics.

Because Tanvelo operates primarily as a Data Processor on behalf of developer teams, inquiries regarding end-user personal data processed via LLM prompts should be directed to the application controller.

7. Contact Information

For security questions, cryptographic disclosures, or privacy requests, please reach out to our security team: