What Vindex does with your prompts, and what it never does.

Every prompt you send is checked against your policy before anything renders. Four checks run today:

Minors, any sexual context

Its own check, on every policy and every plan. Blocked at the prompt. A stated adult age can move a prompt from block to review, never to allow.

Adult content

A level you set, from 1 (safe for work) to 5 (explicit). Past your level, your policy decides what happens: block it, hold it for review, or tag it.

Real people

A named or clearly described real person, famous or not.

Copyrighted characters

Named characters, brands, and the style of a living artist or studio.

Each check asks the screening engine a few questions about the prompt and gets a calibrated probability back. Your policy sets the line each probability is measured against, and what happens when a prompt crosses it. On top of the model, code-side floors look for stated ages under 18, youth slang in several languages, and characters who are minors in their source material. A floor can only ever raise a minors score. Nothing in Vindex reads an adult age as a reason to lower one.

• Never receives or stores images. The API takes text: the prompt, an optional negative prompt, and any metadata or user id you choose to send. There is nowhere to put an image.
• Never shows the text of a prompt the minors check blocked. The dashboard, exports and API reads show a placeholder instead. An owner or admin can reveal it when they have to, and every reveal writes their name, the decision and the time to your audit log.
• Never lets shadow mode wave a minors block through. Shadow mode logs decisions without acting on them, so you can see your numbers first. A block by the minors check is enforced anyway.
• Never turns a failure into an allow. If Vindex can't reach the model, the API returns an error and makes no decision. Your integration decides what happens next, for example holding the generation and retrying.
• Never sells your data, or uses it for advertising or to train models.

Every decision comes back with its reasons. The same explanation is in your dashboard and from the API:

• each check that ran, and its probability against your policy's line;
• the signals that fired, and any code floor that was hit (where in the prompt, never the matched text);
• the exact line of your policy that decided, like checks.minors_sexual.on_act;
• what ran next: tags, a review item, webhooks;
• the policy version and model version it was made with.

A decision explains itself as it was made, even after you change the policy.

Anything your policy sends to review lands in your review queue with its reasons attached, and your team rules on it. Everyone in a workspace has one of three roles:

Owner

Everything, including adding or removing another owner. A workspace always keeps at least one.

Admin

Policies, rules, API keys, billing and people. Can reveal a hidden prompt, and the reveal is logged.

Reviewer

The review queue and nothing else: reads open items and rules on them.

A reviewer sees the text of an open review item, because they have to read it to rule on it. Once a prompt is blocked by the minors check, its text is hidden again. Changes made in the dashboard are written to the audit log.

Your decision log keeps each prompt's text, its decision and its explanation for as long as your plan says, then deletes it:

Starter

7 days

Growth

30 days

Scale

1 year

Enterprise

As agreed in your contract

Your account details stay while your account is open. When you close it, we delete your workspace's data within 30 days. Billing records stay as long as tax law requires. Audit log entries, reveals included, are kept for security even after a workspace is deleted.

• Encrypted in transit (TLS) and at rest, on Cloudflare.
• API keys are stored as SHA-256 hashes and shown to you once. We can't read one back, so a lost key is revoked and replaced.
• Webhooks are signed (HMAC-SHA256), so your endpoint can check a request came from Vindex. Webhook secrets are write-only.
• Each workspace's data is scoped to that workspace on every read and write.
• Least privilege: people get a role, services get their own tokens, and nobody gets more than their job needs.

These companies handle data for Vindex. We email account owners before adding or replacing one.

Customers who sign the DPA can request the named list of sub-processors at any time from hello@getvindex.com. We give workspace owners at least 30 days' notice before adding or replacing one.

Vindex will sometimes be wrong. When it blocks something it shouldn't, or lets through something it should have stopped, email hello@getvindex.com with the decision id (it starts dec_) and what you expected. The id is enough: we can see the decision's scores and explanation from it.

If a prompt involving a minor got through, email us straight away and send the decision id only. Don't forward the prompt or anything made from it. If you find sexual abuse material involving a child on your platform, report it to the NCMEC CyberTipline or your country's hotline.

Found a vulnerability? Email security@getvindex.com with what you found and how to reproduce it. We'll confirm we have it, keep you posted while we fix it, and credit you if you'd like.

Please don't access or change anyone else's data, degrade the service, or publish before we've had a fair chance to fix it. If you act in good faith and stay within that, we won't pursue you for it.

Self-serve plans don't come with an uptime SLA. Enterprise contracts can.