Not Organic / Integration guides
Data & privacy
Keep authorization, content storage, financial records, and provider processing distinct in your integration.
Where information belongs
The client holds its device proof key and scoped access. Product signing keys, model-provider credentials, payment secrets, and account-control credentials belong on trusted servers.
A principal’s account identity comes from verified authorization. Do not expose an API that accepts a browser-supplied DID and forwards it as trusted account identity. Scope the data query or mutation to the authenticated account.
Stored response behavior
POST /v1/responses persists gateway responses by default unless store: false is sent. The Convex adapter encrypts stored response data through OpenBao and assigns a 30-day expiry.
store: false controls this gateway response record. It does not disable the financial ledger, security records, or retention by a selected upstream provider. Do not present it as a global zero-retention switch.
Reading and deleting a stored response require the relevant responses:read or responses:delete capability. Expiry and deletion of a response are separate from account deletion, public protocol records, and copies held by external providers.
Logs and analytics
The gateway’s configured telemetry client uses a pseudonymous identifier and operational metadata. Keep request bodies, prompts, raw identity identifiers, tokens, authorization codes, private keys, cookies, and decrypted content out of telemetry.
For support, collect a request reference, sanitized error code, endpoint path, approximate time, and application version. Remove query strings and fragments before storing diagnostic URLs. Never ask a user to paste an access token into a ticket.
Consent and device controls
Realtime requires explicit content-logging consent in the implemented gateway before the connection is upgraded. An operating-system microphone permission is not a substitute for explaining remote processing and any content logging.
Sign-out, refresh-session revocation, subscription cancellation, export, and account deletion have different effects. Explain the action before asking the user to confirm it. Do not promise deletion of all product and provider data based on removal of one stored response.
Build understandable privacy controls
- Identify which product and data category an export or deletion request covers.
- Verify the requester without collecting unnecessary identity documents.
- Explain retained billing or security records and external-provider limits.
- Report completion only after the underlying operation has completed.
- Use the adopted Privacy Policy and product-specific notices for user-facing commitments.
The public legal pages are review copies until the operator and final policy details are confirmed. This engineering guide is not a substitute for those commitments.