Deploy
Data, privacy and residency
Where requests are served, what is kept and for how long.
What happens to the data you send to the hosted Decision API: where it is processed, what is kept, for how long, and who else handles it. For the full legal detail, read our privacy notice and terms.
Where requests are served
| Model | Served from |
|---|---|
Myles-G 12B myles-g-12b | Canada (region CANADA-1) |
Myles-G 31B myles-g-31b | Canada (region CANADA-1) |
Every hosted model is answered by servers in Canada. The hosted API is not served from the UK today. If your data may not leave the UK, or your own network, run Myles on your own hardware.
What is kept, and for how long
| Data | Kept? | Where | For how long |
|---|---|---|---|
| States, questions and answers of live requests | Not stored | n/a | Processed in memory and discarded once answered |
| Access log of live requests | Method, path, status, time taken and request id only; no content | Canada | See the privacy notice |
| Batch lines (what you send) | Stored encrypted | Canada | Deleted when the batch finishes |
| Batch results | Stored encrypted | Canada | 7 days after you first collect them or 14 days after the batch finished, whichever comes first |
| Account, keys, usage and activity log | Stored | London, UK | Account data until the account is deleted; activity and security logs 12 months, with only the network part of an IP address kept after 90 days |
| Invoices and payment records | Stored | With our payment provider | Six years, as UK tax law requires |
See Batch retention and deletion for how to delete a batch early.
Training
Live requests are not stored, so their content cannot be used to train or tune our models. Batch files are deleted on the schedule above and are not used for training either.
Who else handles data
We use a small number of providers to run the service: the servers that answer API requests, the console's database and sign-in, payments, email and website hosting. Each is named, with what it handles and where, in the privacy notice. Some process data outside the UK, under data processing terms that give the safeguards UK law requires.
Finding a call without its content
Every response carries an X-Request-Id header. Quote it to support and we can find the call in our logs without anyone seeing what you sent. Keep it in your own records next to each decision (see What to log).
Your rights and closing an account
You can ask to see, correct or delete your personal data, or receive a copy of it, at any time through our contact form. Deleting your account deletes its account data; invoices are kept for six years as the law requires.
When data must stay with you
Myles runs on servers, laptops and GPUs you operate, including networks with no connection to the internet, so nothing you decide about ever reaches us. See On your own hardware or request a self-hosted evaluation.