Privacy & masking

Decide where your prompts may go, and what may leave the exchange at all.

Route by privacy properties

• Region — regions: ["eu"] or the eu / us / apac path token.
• Zero data retention — zdr: true routes only to offers declaring ZDR.
• TEE — tee: true requires the attested tier (hardware attestation verified by the exchange). Attestation is coming soon: until it ships, no offer qualifies and such requests return no_eligible_offers.

These are requirements, not preferences: if nothing qualifies, the call fails with no_eligible_offers instead of falling back.

Masking

With mask: true (or X-Thin-Mask: on, or the mask path token), the exchange replaces secrets and personal data in your messages with placeholders before forwarding, and restores the original values in the response — including streamed responses and tool-call arguments.

Detected:

• API keys and tokens for common providers, bearer tokens, JWTs and private-key blocks
• Password and secret assignments
• Email addresses and phone numbers
• Payment card numbers (Luhn-checked) and IBANs (checksum-validated)
• National identity numbers, including the Norwegian fødselsnummer (checksum-validated)

The number of masked values is returned as thin.masked and the x-thin-masked header.

Encrypted debugging traces (opt-in)

Settings lets you retain completed requests and responses for one hour, 24 hours, or seven days. Tracing is off by default. Traces are encrypted at rest, scoped to the workspace, and visible from request details. Masked messages stay masked in stored traces. Zero-retention requests are excluded. Payloads above 256 KB, incomplete streams, and streamed reasoning are not retained. Turn tracing off to erase existing traces, or use Delete stored traces without changing your preference.

Batch inputs and results are stored separately to execute and retrieve the batch. Trace retention does not delete those batch records.

Response cache (opt-in)

With cache: true, identical deterministic requests from your account can be answered from your own cache. Entries are scoped to your account, encrypted at rest, and expire after cache_ttl_s. Cache hits are reported as thin.cache: "hit".

"thin": { "cache": true, "cache_ttl_s": 3600 }