Data handling

Vindex screens text. It checks the prompt before anything is generated, so there is never an image to receive, look at or keep. No part of Vindex stores one: there is no image column anywhere in its database.

What a decision stores

Each decision in your log keeps:

• the text you sent: prompt, negative_prompt and context;
• your user id and metadata, if you sent them;
• per check, the scores, the signals that fired, and any floor hits as a rule name and character offsets, never the matched text;
• the outcome, tags and what ran: review item, webhook deliveries;
• the policy id and version, the check versions and the engine version;
• latency, the input token count, your Idempotency-Key and a hash of the request;
• which key made it (its id, not the key), its mode, and whether it was a dry run.

What the screening model sees

The prompt and negative_prompt, and nothing else: not your context, metadata, user id, key or workspace.

What's never stored

• Images, or anything generated.
• API keys. Only a SHA-256 fingerprint and a short prefix. A key is shown once (API keys).
• Prompt text in logs. Errors are logged by type and code, never with the prompt.

Webhook signing secrets are stored, because Vindex signs with them, but the API never returns one: reads say "redacted".

Who sees prompt text

Anyone with access to your workspace can read its decisions, and a prompt is text your users wrote. One kind is held back:

An owner or admin can reveal one when they have to (reveal=1 on GET /v1/decisions/{id} or GET /v1/review). Anyone else gets 403 reveal_forbidden, and every reveal is written to the workspace's audit log with who and when. The dashboard records its other changes there too: policies, keys, settings, verdicts.

How long it's kept

Each plan says how far back prompts are kept:

Once a day, the text of every older decision is deleted: prompt, negative prompt, context, metadata and reviewers' notes. The decision stays, with its outcome, scores and time, and reads back with prompt_purged: true (Plans & limits). To delete a workspace's data sooner, delete the workspace in Settings, or email hello@getvindex.com.