Security & compliance

How Dynoyard handles your data, keeps it isolated, and stays available — the details engineering, security, and procurement teams ask before rolling out.

Data handling & retention

Prompt & completion bodies are not retained. Requests and streamed responses pass through and are dropped after forwarding — never stored for training or analytics. One narrow exception: error diagnostics (the first ~1KB of an upstream error body on HTTP ≥ 400, with credentials scrubbed) to debug provider-side failures.
Usage metadata — token counts, latency, timestamps, status, model id, API-key id — is retained ~90 days for detailed telemetry; the billing ledger is kept as long as required for accounting.
Card data is handled by Stripe — Dynoyard never sees card numbers.

Model training & enterprise data terms

Dynoyard does not use your prompts or completions to train any model.
Enterprise plans: contractual zero-retention and no training on your data — end to end.

Data residency

Inference is served from EU, Singapore (SG), and US regions by default, unless otherwise agreed.

Isolation

Authentication is per-org, enforced per-key. Prompts from different orgs never share a model’s context or cache. End-to-end isolation, no cross-org leakage.

Compliance

DPA — available; email hello@dynoyard.app for the current template.
Certifications — not currently SOC 2 / HIPAA certified. Our practices are aligned with GDPR principles; formal certification is on the roadmap.
Subprocessors — the inference-partner list is available to enterprise customers under NDA.

Reliability

Status & uptime: status.dynoyard.app
Rate limits are enforced per key under a Fair Usage Policy (FUP); enterprise plans get higher ceilings.

Billing

Prepaid credits by default — hard per-key caps, no billing surprises. Net-30 invoicing available for enterprise.

Contact

Security issues: security@dynoyard.app (coordinated disclosure, 48h response)
DPA / procurement: hello@dynoyard.app