Mallard AI
Create AccountYour Account

Security

Contents
  1. Summary
  2. Data location and law
  3. Zero data retention
  4. Separation between customers
  5. Encryption
  6. Access
  7. Logs and audit
  8. Incident response
  9. Sub-processors
  10. Reporting a vulnerability

Summary

Processing
UK only
Company and law
UK company, English law, UK GDPR
Data retention
Zero data retention (ZDR)
Request logs
Metadata only, up to 30 days
Encryption in transit
HTTPS (TLS 1.2+)
Access to personal data
Director only
Breach notice
Within 48 hours

Data location and law

  • Prompts, images and outputs are processed only in the UK, on servers we run.
  • We return each output to whoever sent the request, and make no other transfer of request data.
  • Accounts, API key hashes, balances and usage counts are held in London.
  • Radiant RX Ltd is registered in England and Wales. Our terms are under English law. Personal data is under UK GDPR, and EU GDPR where it applies.
  • We email customers and routers 30 days before we add or replace a provider that handles request content, or start processing it in a new place.

Zero data retention

Zero data retention (ZDR): we don't store your prompts, images or outputs.

  • A request's content is processed only in our servers' working memory (RAM): the temporary memory a computer uses while it runs a task. Working memory isn't storage. It's cleared as it's reused and when the computer restarts, and nothing in it is saved.
  • To answer repeated prompts faster, the GPU server reuses its work on recent prompts and images from one request to the next. This cache is in working memory only: only the same API key can reuse it, later requests overwrite it, and a restart wipes it.
  • We never use prompts, images or outputs to train or improve a model, and no one at Radiant RX Ltd reads them.

Separation between customers

  • Each API key has its own cache. Name each of your users with user, safety_identifier, session_id, prompt_cache_key or the x-session-id header to give them caches of their own.
  • Only you can see your account's records.

Encryption

  • HTTPS (TLS 1.2 or 1.3) from you to our servers, and only our servers decrypt it.
  • API keys are stored as SHA-256 hashes, and shown once, when you create them. A revoked key stops working within a minute.

Access

  • Only our director has access to customers' personal data. We have no staff or contractors.

Logs and audit

  • Our gateway logs request metadata, never content, image links or IP addresses, and keeps it for up to 30 days. The Privacy Notice lists its fields.
  • Each response carries its token counts in usage and its ID in the X-Request-Id header. Your account page shows your usage by day, and we can send you our metadata lines for your keys.

Incident response

If a personal data breach affects your data, we tell you without undue delay, and within 48 hours of becoming aware of it.

Sub-processors

Our Data Processing Agreement lists our sub-processors, and the Privacy Notice lists everyone who receives personal data.

Data Processing AgreementPrivacy Notice

Reporting a vulnerability

Email report@mallardai.co.uk. We reply within one working day. Our security.txt gives the same address.