Security
Sphere Consulting Group LLC operates the Modelworks inference API. This page says what we do, and what we deliberately do not do.
Where something is not in place yet, this page says so. A security page that overstates is worse than a short one, so the gaps are listed with the same care as the controls.
Last updated: 29 October 2026.
The short version
We do not retain your content. Text you send for synthesis is processed and discarded, and so is the audio returned. We keep request metadata for 30 days, and no request content at all. There is no analytics product, no error-tracking SaaS, no support platform, and no LLM provider anywhere in the path.
That is the entire security story, and it is the reason to use us rather than a cheaper endpoint that keeps everything.
Content and retention
| What | Retained? | For how long |
|---|---|---|
| Text submitted for synthesis | No | Discarded when the request completes |
| Audio generated for you | No | Discarded when the request completes |
| Request metadata - timestamp, endpoint, byte count, status, key used, and the referring page | Yes | 30 days |
| Billing records | Yes | As required for tax and accounting |
Request metadata never contains content. We log how large a request was, not what was in it.
The web server does not store the address a request came from. The access log drops the client address, the port and the browser's User-Agent before the line is written, so the log cannot be used to identify a visitor, including by us.
We do not train on your data. We do not use it to improve models. We do not sell it, and there is no third party in the path to sell it to.
Where it runs
Compute is hosted by Hetzner Online GmbH, in the European Union. Cloudflare serves DNS only - the records are not proxied, and TLS is terminated on our own host by Caddy with an ACME certificate, so Cloudflare does not see request content and holds no TLS keys. That is a property of the DNS configuration rather than a promise about a vendor, and it is checked at deployment.
The full sub-processor list is published separately and changes are announced 30 days in advance.
Encryption
In transit: TLS 1.2 or higher on every API endpoint, terminated on our own host with an ACME certificate. Plain HTTP is redirected to HTTPS; the API itself is only served over TLS.
At rest: the database and the host's volumes are not encrypted at rest beyond whatever the provider applies to its own storage, and we do not claim disk encryption we have not implemented ourselves. What the host provides will be stated here once it is confirmed in writing.
Access
- API keys are per-customer and can be revoked individually without affecting anyone else.
- Keys are stored hashed, never in plaintext, so a database disclosure does not yield working credentials.
- The operator's own access is limited to what is needed to run the service. Because content is not retained, that access does not extend to customer content.
- No shared credentials. Every customer gets their own key.
Isolation
Requests share an inference process. The engine serves several requests concurrently in one process on one host; there is no per-customer process or container isolation. What separates customers is the key, the budget enforced against it, and the fact that nothing of theirs is retained - not isolation. If a review requires isolation, say so and that is a different conversation; nothing here claims it.
Incident response
We notify affected customers within 72 hours of becoming aware of a personal data breach, and we notify you rather than any supervisory authority - that is your obligation and your decision, not ours.
The breach runbook is written; it has not yet been exercised end to end, and this page will say when it has.
What we do not have yet
We do not have SOC 2. It costs $20,000 to $35,000 all-in and it is commercially triggered rather than legally required at our size. We will get it when a customer's contract depends on it, and we will say so here when we do.
We do not have a penetration test report. A customer whose review requires one is how that gets bought.
We do not offer an SLA. We run on a small number of hosts and will not promise an uptime we cannot control. The status page is the substitute: checks, the latency we measure, and every incident with its times.
Compliance
GDPR. A Data Processing Agreement incorporating the Standard Contractual Clauses, Module Two, is published and takes effect with the terms. India is not subject to an EU adequacy decision, so SCCs are the transfer mechanism. A Transfer Impact Assessment is available to the Controller on request - it exists as a review draft (DPA Annex 3) and is not described as final until a qualified professional has reviewed it.
DPDP Act 2023. As a processor, our obligations flow down contractually from our customers rather than attaching directly to us.
HIPAA. We do not serve protected health information, and cannot until the hosting provider will sign a Business Associate Agreement. Do not send it.
Contact
Security questions, DPA requests, and vulnerability reports: support@modelworks.dev. It is the same address published for the free tier and for support, and it is read.