Security

• No storage. Customer Content is never written to any database, file system, log, analytics system, error report or monitoring system.
• No personnel access. Customer Content is not accessible to any Subconscious employee or contractor, during processing or after.
• No training. Customer Content is never used to train, fine-tune or evaluate any model.
• No disclosure. Because no copy is retained, Subconscious holds no Customer Content that could be disclosed in response to legal process, a support request or a security incident.

These commitments are contractual. They appear in Section 2 of our Terms of Service and Section 1 of our Privacy Policy.

The only record Subconscious keeps of an inference request is usage data, which records how much was processed and never what was sent or received.

Usage data supports billing, spend controls, capacity planning and the request-level usage logs available to customers in the platform.

To reduce the cost and latency of long-running sessions, the Subconscious runtime caches repeated context. Cache data is:

• stored solely in an encoded, non-human-readable format;
• held only within Subconscious's inference infrastructure;
• used only to accelerate the processing of requests;
• inaccessible to Subconscious personnel; and
• deleted no later than 24 hours after creation.

All traffic to and from the Subconscious website, platform and API is encrypted in transit using industry-standard TLS. Inference requests are routed to our compute providers over encrypted connections.

• Platform access is authenticated and scoped to the customer's organization.
• API keys are issued per organization, are required for every inference request and may be revoked by the customer at any time.
• Customers may set a monthly spend limit, receive automated alerts at 75% and 100% of that limit, and choose whether the limit acts as a hard stop on further requests.
• Internal access to production systems is restricted to authorized personnel on a least-privilege basis.

Model inference runs on GPU infrastructure supplied by Aranya, Baseten, Google Cloud Platform and Moonlite. Compute providers process Customer Content only as necessary to fulfill requests and are bound by the same zero data retention, no-access and no-training restrictions that apply to Subconscious.

Each provider is selected for its security posture and maintains an independent security program. The complete list of providers and their trust centers is maintained on our Subprocessors page.

Customers with additional isolation requirements may run Subconscious on a dedicated deployment in our cloud, within their own cloud environment, or on their own hardware. Where Subconscious operates within a customer's environment, Customer Content remains in that environment.

Subconscious investigates suspected security incidents promptly. If an incident affects customer information, Subconscious will notify affected customers as required by applicable law and by the terms of any agreement with them. Under zero data retention, no Customer Content is available to be affected by an incident involving Subconscious's stored data.

Subconscious welcomes reports of suspected vulnerabilities at security@subconscious.dev. We investigate all good-faith reports and remediate confirmed issues promptly. We ask that researchers allow a reasonable period for remediation before any public disclosure and refrain from accessing data that does not belong to them.

For questions about our security practices, or to request security documentation for a vendor review, contact security@subconscious.dev.