Security and data handling
Niyoos does not log the bodies of your prompts or the model’s responses. It forwards them to the provider you chose and keeps metadata about each call, with two narrow exceptions set out below. This page sets out exactly what we keep, where, for how long, who processes it, what happens when things fail, and what we have not done yet.
Last updated 28 October 2026
What we store, and what we don’t
Stored for every call
- Time, agent, model requested and model served, provider credential used
- Token counts (input, output, cached, reasoning) and the computed cost
- Latency, success or failure, and an error classification
- The names of tools the model called, and run and workflow identifiers
- The calling client and its User-Agent, the client IP address, and one-way fingerprints used for loop detection
- When a provider rejects a request, up to 200 characters of its error message. Some providers quote part of the request in that message, so it is kept apart from the audit trail and erased with the agent
Not stored
- Prompt and response bodies. Two things can contain fragments of them: a provider’s error message (above) and tool details, if you switch them on (below)
- Tool results
- Payment card data (payments are handled by Razorpay; we never see card numbers)
Stored only if you switch it on: tool details
Tool details are off for every agent until an admin switches them on. Then the arguments of each tool call are masked, capped at 16 KB, encrypted with AES-256-GCM under a per-organisation key, and deleted after 30 days. Switching them off deletes what was kept. Every view is recorded in your audit trail.
How long we keep it
| Data | Kept for |
|---|---|
| Call metadata | Kept 12 months, then deleted automatically (sooner if you delete the agent or your organisation). |
| Tool details (if on) | 30 days, then deleted with their encryption key. |
| Audit trail | For the life of your organisation; archived copies are held for 90 days. |
| Provider keys | Until you remove the key or delete your organisation. |
Encryption
- In transit: HTTPS with TLS 1.2 or 1.3 to the API; plain HTTP is redirected. Database connections are encrypted.
- At rest: the database and its snapshots are encrypted with a customer-managed AWS KMS key.
- Your provider API keys are wrapped with AWS KMS envelope encryption.
- Tool details, if switched on, are encrypted with AES-256-GCM under a per-organisation, per-day key.
Where it runs
The API, database, audit archives and encryption keys run on AWS in Mumbai (ap-south-1), India. Today that is a single service in one region. The website and dashboard are served by Vercel.
What happens when something fails
If Niyoos is unreachable
Calls routed through Niyoos fail until it is back. There is no automatic bypass. You can point your base URL back at your provider at any time.
If our internal store fails
Niyoos fails open: requests keep flowing to your provider, but spend caps, rate limits and loop detection stop until it recovers. Each lapse raises an alarm for our team, and a cap or rate-limit lapse is written to your own audit trail, so you can see exactly when enforcement was off.
How the audit trail works
Each record is hashed with SHA-256 together with the hash of the record before it, so altering any record breaks every link after it. Each record also carries a keyed seal we hold, and the chain is checkpointed with signatures from AWS KMS. You can verify the chain from your dashboard, and admins can export it to check offline.
We also publish a Record Integrity Register: every time our own records turned out to be wrong, and what we did. Read the Record Integrity Register
Sub-processors
| Company | What for | Location |
|---|---|---|
| Amazon Web Services | Hosting: compute, database, storage, keys, logs | Mumbai, India (ap-south-1) |
| Clerk | Sign-in and organisation management | United States |
| Resend | Transactional email (alerts) | Tokyo region |
| Vercel | Hosting for the website and dashboard | Global edge network |
| Your chosen LLM provider | Receives your prompts, on your instruction; we do not store them | Per provider |
This website loads no analytics. The dashboard’s public pages use Google Analytics only after you accept it; see the Privacy Policy.
If you connect through n8n, Zapier or Make, that platform keeps each step’s input and output, your prompt and the response included, under its own retention settings. Calling Niyoos from your own code leaves no copy on a third party.
Compliance status, honestly
Niyoos has not been SOC 2 audited, holds no ISO 27001 certification, and has had no independent penetration test. We would rather tell you that than imply otherwise. What we do operate is described on this page and in the Privacy Policy.
Report a security issue
Email security@niyoos.com. We treat good-faith reports seriously and will not pursue a reporter who acts responsibly and does not access or remove other people’s data.