Blind hop

Vectors in, vectors out. The prompt is not in our logs.

Redline runs its own tokenizer on the gateway so a request can be priced without keeping the words. What the model host consumes is token ids. What we keep is a hash, a model name, a token count and a cost.

A prompt is a string only until it hits the Worker. There it is turned into tokens so we can reserve the worst-case cost, then forwarded. The accelerator on the other side of that hop does not read English. It reads vectors in and writes vectors out. We never write the plaintext to D1, to the request log, or to disk. There is nothing to look up later, which is the whole point for a red team whose prompts are the engagement.

We cannot claim the model host never sees the tokens. Inference has to happen somewhere, and for the length of one request those tokens are in memory on that hop. What we can claim, and what the receipt proves, is that Redline itself does not retain them. The row we store is model, token counts, cost, latency. The receipt adds a SHA-256 of the messages as they were sent, signed with an HMAC under the gateway's master key, so you can prove later that this is all we bound to.

What the receipt is

Every /v1/chat/completions response, streamed or not, carries an X-Redline-Receipt header. The Playground shows "receipt issued" when one comes back. The token is rlr1.<payload>.<sig>: a JSON body of { v, model, prompt_sha256, ts }, HMAC-SHA256 with the same 32-byte key that seals stored credentials. The plaintext of your messages is not in it. If it is not in the receipt, it is not in our database.

Paste a receipt below. Optionally paste the messages array you sent; we hash it the same way the Worker did and tell you whether it matches. A match means this receipt was issued for those messages. A miss means these are not the messages that receipt bound to. A bad signature means it did not come from this gateway.

Receipt Messages JSON, optional

What we do store

The model id, token counts, billed nano-dollars, latency and outcome, for 90 days.
The key that spent, so a cap can be enforced and a bill can be explained.
Nothing of the prompt, the completion, or the tools array.

That is the same policy as the homepage already states. The receipt is how you check it from outside the trust boundary, rather than taking the copy at its word.