LEGAL
Data residency
Which component runs where, and what each one stores. The portal, the gateway and both databases are in Sydney; encrypted backups are kept in Singapore. Modelvia does not store prompts or completions in its gateway or databases. Every model except DeepSeek V4.1 Flash is served by a host OpenRouter lists as zero data retention; DeepSeek V4.1 Flash is served by DeepSeek's own endpoint, which is not.
Component by component
| Component | Provider | Region | What is stored |
|---|---|---|---|
| Portal and website | Vercel | Sydney, Australia (syd1) | Nothing persistent. It renders pages and forwards authenticated calls to the gateway. |
| API gateway | Fly.io | Sydney, Australia (syd) | Request content is processed in memory. Backup jobs write a temporary plaintext database dump to local disk, encrypt it into a staged archive, and attempt to remove the temporary files in cleanup. A crash may interrupt cleanup. |
| Ledger database | Neon (PostgreSQL) | Sydney, Australia (AWS ap-southeast-2) | Accounts, keys as hashes, request and usage records, rate cards, invoices, statements, payments and the ordered financial event log. |
| Identity database | Neon (PostgreSQL) | Sydney, Australia (AWS ap-southeast-2) | Email addresses, password hashes, second-factor enrolment, sessions and workspace memberships. |
| Database backups | Object storage for the Neon databases | Singapore, kept outside Australia on purpose so one regional outage cannot take both the databases and their backups | Encrypted archives of the two databases above. |
| Model hosting | OpenRouter, then the reviewed host listed for each model: DeepSeek's own endpoint (DeepSeek V4.1 Flash, not zero data retention); Amazon Web Services (Bedrock), with Google (Vertex AI) as a same-price fallback, both zero data retention (Claude Sonnet 5.5) | OpenRouter: United States. Model host: determined by the endpoint OpenRouter dispatches to for that model; not yet verified | Receives the prompt in order to serve it. Every call except DeepSeek V4.1 Flash requires a zero-data-retention endpoint, denies data collection and disables OpenRouter's response cache. DeepSeek V4.1 Flash is the exception: it goes to DeepSeek's own endpoint without zero data retention and with data collection allowed, so DeepSeek may retain that content and use it under its own terms. Claude routes ask the host to keep the prompt prefix for up to 5 minutes, so the next turn of the same conversation is faster and cheaper; that cache is keyed to one tenant's conversation. |
| Computer-use decisions | OpenRouter, then Jev (TypeSafe, zero data retention) or GPT-6 Luna Decisions (OpenAI, not zero data retention) | OpenRouter: United States. Jev and OpenAI: determined by that service; not yet verified | Receives the state and questions an app sends to /v1/decisions, which may include screen or page text. Luna Decisions is the one exception to zero data retention: OpenAI may keep that content under its standard API retention (up to 30 days, for abuse monitoring). Data collection for training is denied on both. |
| Routing classification | Jev / TypeSafe | Determined by that service | Receives the conversation messages, whether tools are available and the output ceiling, only when a request asks for the auto model and more than one route could serve it. |
| Customer payments | Square | Determined by the client's own Square merchant account | Card details, which never reach Modelvia. We hold the order, invoice and payment identifiers. |
| Account and operational email | Resend | Primarily United States per Resend's DPA; this account's sending region is unverified | Receives recipient email and the message: one-time account setup or recovery link with expiry, or a redacted operational alert. This account's sending region and supplier retention require verification before external onboarding. |
How to read this
- Stored data sits in Australia; its backups do not. Since 8 October 2026 the gateway and both databases run in Sydney. Encrypted backups are kept in Singapore so a regional outage cannot take both. If your obligations require Australian backups too, say so before you connect — this is a deployment decision, not a setting.
- Prompts leave the region by design. They go through OpenRouter to the host that serves the model, wherever that host runs, and they are not stored on our side at either end.
- Money stays. Invoices, statements and financial events are retained in the ledger — see retention.
- Card details never reach us. They are handled by Square under the client's own merchant account.
Modelvia is a single-instance private pilot. See service levels for what that means for availability, and status for what the gateway is reporting right now.