Trust Center

Ache AI operates ache.lol from the United States. Application and database hosting run on self-operated application servers in the United States. We are an independent team building a hosted AI assistant — not a data broker and not an ad network. For privacy or security questions, contact [email protected] or [email protected].

• We do not use your chats to train models or sell data to advertisers.
• Passwords, session tokens, and API keys are stored hashed; BYOK provider keys and integration tokens are encrypted at rest.
• Authentication and team administration events (sign-in, sign-out, password changes, API key create/revoke, and team membership or role changes where logged) are recorded in an audit trail visible to team administrators.
• Data in transit is encrypted with TLS. Credentials, BYOK keys, and integration tokens are encrypted at rest.
• Employee access to customer content is limited to what is needed to operate the service, investigate abuse or security issues you report, or comply with law — not for advertising or model training.
• Cookie-authenticated writes require a trusted Origin; outbound webhooks are validated against SSRF; rendered markdown and outbound links are sanitised in the web app.
• Every production change runs through automated secret scanning, dependency audit, build, and test gates before deploy.
• You can export, delete, and revoke data from the dashboard. Incognito chats are not written to our database.

We do not claim to be the largest AI provider. We do claim to be clearer about what happens to your data — and to give you controls many consumer assistants hide behind settings.

• Training. We do not use your chats to train models. Consumer ChatGPT and Claude may use conversations for training unless you opt out or use an enterprise/API plan with different terms. Ache's default is no training — no toggle required.
• Retention. Delete conversations, memory, and your account from the dashboard. Incognito chats are server-enforced and never written to our database.
• Code & repos. Code mode runs each project in a dedicated Firecracker microVM on runner infrastructure we operate. Repository content is processed for the active task you run, not indexed for always-on cloud retrieval.
• Model routing. You choose the model in the product. OpenRouter-backed credit models default to Ache ZDR (Zero Data Retention providers, data_collection: deny, no training). Ache Expanded is an optional opt-in for models without a ZDR provider — upstream providers may retain sanitized prompts per their policies. BYOK routes use your key and your provider's terms. See Provider API data policies below.
• Tracking. No analytics pixels, ad trackers, or session recorders in the app.

Third-party model providers apply their own terms when you select them or use BYOK. See our subprocessors below and each provider's trust documentation.

These third parties may process personal data when the related feature is used or enabled. Model providers depend on the route you select; see /models and Provider API data policies below. For route-by-route upstream vendor names and pinned provider slugs, contact [email protected].

Subprocessors that process personal data on our behalf are contractually required to handle data only for the listed purpose, except where a feature is user-initiated (for example, a model provider you select, or an integration you connect).

Each card lists one subprocessor. The full table is available on larger screens.

Subprocessors that process personal data on our behalf are required to handle data only for the listed purpose and implement appropriate security measures, under written data-processing terms where we act as controller or processor.

We update this table when subprocessors change. Material additions are announced at least 30 days in advance where practicable, and reflected in the Privacy Policy.

Vendor trust documentation: Cloudflare Trust Hub · Resend Privacy · Model providers: see links on /models.

Primary account data is stored in the United States. Subprocessors may process data in other regions as listed above. For EEA/UK/Swiss transfers, we use Standard Contractual Clauses (and UK addendum where required) and implement supplementary measures including encryption in transit and at rest, access controls, and data-minimisation in logs. Contact [email protected] for a copy of our transfer safeguards.

Ache controls retention for data stored on our infrastructure. Third-party retention is governed by each vendor's own policy:

• Ache AI (primary) — chats, memory, uploads until you delete them; Code mode workspaces per the Privacy Policy lifecycle; backups up to 30 days after production deletion.
• Cloudflare — connection metadata per Cloudflare's data retention documentation.
• Ache Search — search queries and fetched pages are processed by the Ache Search service we operate, which queries public search engines through our own SearXNG instance. Requests carry our server identity, not a customer identifier, and page content is cached in a shared or per-key cache according to the search scope. The upstream engines' own retention and training terms apply to what they receive.
• Hosted model providers — credit-funded OpenRouter models use Ache ZDR or Ache Expanded operator routing; other credit routes and BYOK use direct APIs or your key. See Provider API data policies in this Trust Center.
• Resend, Composio, Sentry — per each vendor's published retention schedule for the data categories they receive.

For a current table with purpose and region, see Subprocessors above. For vendor review, contact [email protected].

Credit-funded models (Ache credits)

Credit-funded models (aik in /models) route through operator infrastructure. Ache does not train on your chats. Chat history is still stored in Ache unless you delete it or use Incognito. OpenRouter-backed credit models use one of two routing modes:

• Ache ZDR (default) — for OpenRouter-backed models with an eligible Zero Data Retention provider. Requests route through OpenRouter to ZDR-classified upstream providers only, with data_collection: deny and zdr: true on each request. Upstream ZDR providers do not retain prompts for training or logging beyond inference. Some models pin one upstream provider slug; others let OpenRouter choose among eligible ZDR providers only.
• Ache Expanded (optional opt-in) — for OpenRouter-backed models without an eligible ZDR provider. You must enable Expanded Model Access in account settings. This unlocks additional models. Requests still set data_collection: deny (no training), but upstream providers may retain sanitized prompts per their own policies. OpenRouter guardrails may redact sensitive data before forwarding to providers, but detection is not infallible — do not treat Expanded as equivalent to Ache ZDR for confidential work. All Expanded traffic is processed through OpenRouter.
• Direct model API routes — some credit models (for example DeepSeek-branded entries) call a provider API directly. Stateless inference with model-improvement opt-in disabled on our operator account; prompts are not used to train models.
• Renewable free-pool routes — ache/free* and ache/auto. Operator API keys to third-party inference APIs under each API's standard terms — not the Ache ZDR or Ache Expanded configuration used on paid OpenRouter credit routes. Avoid for confidential work unless you have reviewed each possible upstream.

Free pool warning: ache/free* and ache/auto do not use the same operator routing guarantees as paid aik credit models.

Route-by-route breakdown

Swipe the table on small screens.

For vendor review with upstream vendor names and pinned provider slugs per model, contact [email protected].

BYOK models (your API key)

When you add your own provider key, you pay the provider and their API terms govern training, retention, and zero-data-retention — not Ache's credit infrastructure. Common BYOK providers and their published API defaults:

Swipe the table on small screens.

Important: BYOK means you configure ZDR and retention on your provider account. Ache still stores chat history unless you use Incognito. OpenRouter credit models use Ache ZDR or Ache Expanded operator routing described above — not your BYOK key.

Code mode runs each active project in a dedicated Firecracker microVM on runner infrastructure we operate. Each workspace gets its own guest VM with an isolated root filesystem; tenant workloads on a runner host are separated at the hypervisor level. The control plane communicates with the runner over an authenticated API using a shared secret.

• Filesystem — repository files live on the workspace VM disk while active; archived checkpoints are stored on runner infrastructure with the lifecycle described in our Privacy Policy.
• Encryption — integration credentials and BYOK keys use AES-256-GCM at rest; workspace disks use full-disk encryption on the runner host.
• Network — guest VMs can reach the public internet for package installs, git operations, and dev-server previews you start; outbound traffic is not a general open relay to other customers' workspaces.
• Operator access — there is no self-service operator UI to browse workspace files. Direct operator access to workspace content is being extended with actor/timestamp/reason/scope audit records — see Common enterprise questions.

Incognito mode does not apply to Code mode — workspace files follow the Code mode lifecycle regardless of chat privacy settings.

Which models have the shortest provider-side retention through Ache?

For credit-funded OpenRouter models, use Ache ZDR (default) — ZDR upstream providers only, data_collection: deny, no training. Models without a ZDR provider require Ache Expanded (opt-in); upstream providers may retain sanitized prompts per their policies. Direct API and free-pool routes differ — see the route-by-route table above. Ache still stores chat history in our database. For the shortest overall footprint, use Incognito (RAM-only, up to 24 hours) or BYOK with zero-data-retention on your provider account.

Do you plan SOC 2 Type II, ISO 27001, or an independent penetration test?

We have not published SOC 2 Type II, ISO 27001, or an independent penetration-test report yet. SOC 2 Type II is on our roadmap, and we plan to commission an independent penetration test and publish status or summary in this Trust Center when complete. Until then, controls are documented here, in our Privacy Policy, and in our security policy.

Is every direct production access to customer content logged and reviewed?

Today: authentication, API key, team administration, and dev-portal actions are logged. There is no general-purpose operator UI to browse customer chats. In progress: individual audit records for every direct operator access to chat content or Code mode workspace files (actor, timestamp, reason, scope) with periodic review. Contact [email protected] for current deployment status in vendor review.

Will you add automatic chat deletion (7 / 30 / 90 days)?

Not available today — chats persist until you delete them. Configurable automatic chat expiry is planned. Contact [email protected] if you need this for a team rollout before it ships in-product.

Will you support true zero-retention BYOK (no Ache or provider retention beyond inference)?

Not today. BYOK still stores chat history in Ache unless you use Incognito (RAM-only, up to 24 hours). Upstream retention is controlled by your provider account (enable ZDR where offered). A dedicated zero-retention BYOK mode is planned so neither Ache nor the provider retains prompts/outputs beyond what is technically necessary for a single request, when your provider supports it.

Known product tradeoffs

These are intentional today, not undisclosed gaps:

• No published SOC 2 Type II, ISO 27001, or independent pen-test report yet (on roadmap).
• No automatic chat expiry — delete manually or wait for planned configurable retention.
• No zero-storage BYOK chat-history mode — use Incognito if you do not want Ache DB writes.
• Incognito stays in server RAM up to 24 hours (or until restart); usage/billing metadata is still recorded without a conversation ID.
• Incognito applies to chat only — not Code mode workspaces.

Team workspaces include role-based access, audit events, budgets, and shared API-key metadata. Team administrators control members, integrations, and webhook destinations.

For vendor review, we provide our standard DPA on request, a subprocessor list, and answers to common security questionnaires. Email [email protected] for the current DPA or [email protected] for other vendor questions. We respond to verified business requests within 30 days. Enterprise teams needing contractual zero-retention API terms or custom data-handling commitments should contact [email protected] before rollout.

Request a DPA

Report vulnerabilities to [email protected]. Do not open public GitHub issues for security bugs. We aim to acknowledge reports within 5 business days. See our security policy for scope and safe-harbor guidelines.

Ache AI is operated from the United States. Primary account data is stored on self-operated application servers in the United States. Service availability is published at /status.

Unless you have a separate signed agreement, the service is provided without a formal SLA. Security and privacy controls described here apply to the standard hosted service at ache.lol.

We have not published SOC 2 Type II, ISO 27001, or an independent penetration-test report. Controls are documented here, in our Privacy Policy, and in our security policy. Business customers may request security questionnaire responses at [email protected].