1. Zero Data Retention by default
Zero Data Retention (ZDR) is enabled by default on every Mesh API account. You do not have to request it, negotiate it, or be on an enterprise plan to get it.
- Your content is not stored. With ZDR on, prompt and completion content passes through the gateway in memory and is never written to our logs or databases.
- We never train on your data. Mesh API does not use your prompts, completions, files, or embeddings to train, fine-tune, or evaluate any model, ours or anyone else's.
- We never sell or share it. Your content is not sold, rented, or shared for advertising, marketing, or any purpose other than fulfilling your request.
- Only billing metadata is kept. Model name, token counts, latency, cost, and a request ID are recorded so you can audit usage and we can invoice accurately. That metadata contains no prompt or completion text.
- If you turn ZDR off. Some teams disable ZDR to get request-level debugging and context. In that case prompt and completion content and related context may be retained for up to 90 days, and longer only where law or a signed contract requires it. The no-training and no-selling commitments still apply.
- Third-party providers. To answer a request we must transmit it to the model provider you selected. That provider's own terms and retention practices apply to the content it receives.
The same commitments are written into our Privacy Policy and Terms & Conditions.
2. Compliance engagement
Fiesta Labs Inc. has engaged Scrut Automation Inc. to assess our internal controls and alignment with:
- SOC 2 Type 2
- ISO 27001
- EU GDPR
Operations were initiated on 13 May 2026 and have been completed. The engagement letter below confirms the scope of this work.
3. Certification status
SOC 2 Type 2
Independent SOC 2 Type II audit completed. Report available on request.
ISO 27001
ISO 27001 certified information security management system. Certificate available on request.
EU GDPR
EU GDPR compliant processing, backed by our DPA and sub-processor list.
4. Security features
Mesh API includes built-in protections designed to keep your traffic secure, stable, and auditable.
Prompt injection prevention
Input prompts are inspected and sanitized to detect and block injection attempts before they reach provider APIs.
DDoS protection
Rate limits and traffic shaping protect our endpoints from abuse and keep the service available.
Load balancing
Requests are distributed across healthy infrastructure so latency stays low and failures are isolated.
100% Traceability
Every request gets a traceable ID so you can audit usage, debug issues, and monitor spend.
PII protection
Built-in detection helps identify sensitive information so it can be handled according to your policies.
Zero Data Retention (ZDR)
On by default for every account. Prompt and completion content is never stored in our logs. Only token counts, model, latency, and cost are tracked for billing.
5. Current security practices
Alongside these certifications, we follow security practices designed to protect customer data:
- Encryption in transit: All traffic to Mesh API services is encrypted with TLS.
- Access controls: Internal access to infrastructure and customer data is limited to authorized personnel and protected by multi-factor authentication.
- Infrastructure: Services run on managed cloud infrastructure with regular patching and monitoring.
- Data handling: Zero Data Retention is on by default, so we keep only the billing metadata needed to run the service. We never train on your prompts or outputs. See our Privacy Policy for details.
6. Shared responsibility
Mesh API secures the platform, but customers are responsible for how they use it. This includes safeguarding API keys, configuring access appropriately, and ensuring that prompts and data sent to third-party AI providers comply with their own policies and obligations.
7. Security and compliance contact
For security questions, compliance requests, or to report a vulnerability, contact us at contact@meshapi.ai.
- SOC 2TYPE II
- ISO27001
- GDPREU