Security and privacy
What happens to your data from the upload to the model, and who sees what.
Your files
- Masking first. Before anything else reads your data, we mask personal data: names, emails, phone numbers, documents such as CPF and CNPJ, and card numbers. The original upload is deleted as soon as the masked copy exists.
- The agent sees samples, not files. The structuring agent (a language model reached through OpenRouter) sees the shape of your data and masked samples, never the raw files.
- Training machines are temporary. Training runs on GPUs rented from vast.ai. They receive masked data only, and each machine is destroyed when the run ends.
- Jev only measures. The comparison sends the masked test examples to Jev through OpenRouter. Its answers are used to measure, never to train.
- Your choice to skip masking. If you declare that your files hold no personal data, masking is skipped, at your request and responsibility.
Your model
After training, the model runs where you put it: in your servers, your cloud, the browser or a phone. What you ask it never comes back to us. It is a file, not a service you depend on.
Your account
- Passwords are stored only as a hash; you can also sign in with a passkey, Google or Hugging Face.
- API keys are stored only as a SHA-256 hash and are shown once. They start with
ts_, so secret scanners can spot a leaked one. - AI assistants on the remote MCP server get access only after you sign in and allow them (OAuth with PKCE); their tokens are tied to that server and expire within an hour, renewed while the connection lasts.
- Every call is checked against the owner: one account never reads another's datasets or models.
How long we keep things
See Retention. The privacy policy is the full and binding version of this page, with the list of providers that process data for us.