Skip to main content
The Orq.ai Trust Center holds the platform’s security certifications, audit reports, and compliance documentation. Open trust.orq.ai to request access, or see Trust Center for the full list of available artifacts.

​
User-Controlled Model Integrations

Users integrate their own API keys and select the model providers they want to work with. As a result:
  • Orq.ai does not require Data Processing Agreements (DPAs) with model providers nor is Orq.ai a subprocessor for the model providers.
  • Whether a model trains on the data depends on settings configured on the provider’s side. Most providers allow training to be disabled; this must be configured directly in the provider’s platform by the user.

​
No Model Training on Platform Data

No data that flows through Orq.ai is ever used to train or fine-tune any models by Orq.ai. Input and output data in traces, logs, threads, and responses are processed for observability and evaluation purposes and retained only for the configured retention period.

​
Privacy and Masking Controls

Orq.ai includes features to help ensure data privacy and regulatory compliance:

​
Input Masking

Input variables can be flagged as Personally Identifiable Information (PII), which includes Personal Data. These are sent to the model but are not stored or shown in logs.
Variables panel showing the Question variable with a dropdown to set it as None or Personally Identifiable Information (PII).

Flag an input as PII in the Security tab of your variant. Once deployed, the value is sent to the model but never stored.

​
Output Masking

Entire model responses can be masked. While tokens are still exchanged with the model, the content is never stored or displayed within Orq.ai.
Variables panel with city and date variables, and a Masking section with the Output Masking toggle enabled.

Enable Output Masking to prevent generated responses from being stored in logs and traces.

These features allow models to function as intended while ensuring sensitive data remains confidential. Read more about how to configure this in Orq here: Deployment Security and Privacy

​
Security and Compliance

  • Compliance is maintained through Vanta, supporting both SOC 2 Type 2 and GDPR standards. Audit reports and the current status are at trust.orq.ai.
  • Security oversight is provided by an independent Chief Information Security Officer (CISO).
  • All data stored within the Orq.ai-hosted platform resides in data centers located in the European Union.

​
Data Retention

Retention-covered data is retained only for the duration of the configured retention period. This allows users to review logs and traces for observability. After the retention period, it is automatically deleted. Datasets, media and file attachments, evaluator results, and annotations are not retention-covered and persist until manually deleted. See Data Retention for covered data types and retention periods by plan.

​
Erasure and Access Requests

Data is erased through one of three routes:
  • Retention expiry: tracing data and other retention-covered records are deleted automatically once the configured retention period ends. Retention follows the subscription plan and is covered per data type in Data Retention.
  • Manual deletion: datasets, media and file attachments, evaluator results, and annotations are deleted on demand. Remove an uploaded file with Delete a file.
  • Workspace deletion: archiving a workspace schedules its permanent deletion 14 days later, removing the workspace and all of its data. See General Settings.
To erase a specific end user’s data, or to answer an access request, contact support@orq.ai.