OpenRouter zero data retention routing
Every model call from the estate goes through OpenRouter. The confidentiality question is therefore two-layered: what OpenRouter itself does with the data, and what the downstream provider does. This page documents the setting that restricts traffic to zero-retention hosts, the evidence behind it, and how to verify or disable it.
The setting
Section titled “The setting”~/.hermes/config.yaml:
provider_routing: data_collection: denySemantics (OpenRouter API): each request carries a provider preference data_collection: "deny", which restricts routing to providers that neither store nor train on prompts. It is applied by the Hermes runtime to every request path — messaging gateway, CLI, cron jobs, and auxiliary calls (vision, compression, web extract, title generation). Providers that retain prompts (e.g. for abuse monitoring) are excluded as well.
This is a request-layer flag, independent of the account-level privacy settings on openrouter.ai. It survives any change of account settings and applies to any machine using this key.
Why it matters for the Workspace API
Section titled “Why it matters for the Workspace API”The Google Workspace integration (see Google Workspace read access) processes personal documents and correspondence. Any document the agent reads is embedded in the model context and transits the LLM call. Scopes are read-only (the agent cannot modify anything), but read-only does not change the transit itself — retention and training protection comes from routing.
What the setting changes — and what it does not
Section titled “What the setting changes — and what it does not”| Before (default routing) | After (data_collection: deny) |
|
|---|---|---|
| Model | deepseek/deepseek-v4-flash-0731 |
Identical — config unchanged |
| Host serving the model | DeepSeek first-party or any available endpoint | Zero-retention hosts only (DeepInfra, SiliconFlow, Novita, Together, …) |
| Price range | Official DeepSeek pricing | Comparable — often lower (hosts compete) |
Premium fallbacks (gpt-5.6-luna etc.) |
Inactive unless the main model fails | Unchanged |
The model is the same weights either way — the setting only restricts which provider’s servers run the inference. OpenRouter (the router) never runs the model itself; it selects a host and forwards the request.
Cost of the default model on ZDR endpoints
Section titled “Cost of the default model on ZDR endpoints”Pricing as of 2026-08-29 for deepseek/deepseek-v4-flash-0731 (22 ZDR endpoints, from /api/v1/endpoints/zdr):
| Host | $/M prompt tokens | $/M completion tokens |
|---|---|---|
| OpenInference | 0.030 | 0.100 |
| Relace | 0.045 | 0.090 |
| Sail Research | 0.065 | 0.180 |
| DeepInfra | 0.080 | 0.180 |
| DigitalOcean | 0.080 | 0.252 |
| Makora | 0.090 | 0.195 |
| Morph | 0.099 | 0.278 |
| AkashML | 0.100 | 0.280 |
| Range (all 22) | 0.030 – 0.44 |
This is the low-cost tier of the estate configuration (~$0.1/M tokens). Enabling deny does not move the default toward a premium model: the main model stays deepseek/deepseek-v4-flash-0731, and gpt-5.6-luna remains limited to delegation/vision auxiliary calls, as before.
Provider policies (as of 2026-08-29)
Section titled “Provider policies (as of 2026-08-29)”From the OpenRouter all-providers endpoint:
| Provider | Retention | Training |
|---|---|---|
| DeepSeek (first-party) | unknown duration | ✕ may train |
| Mistral (first-party) | 30 days | ✓ no training |
| DeepInfra, Novita, Fireworks, Together, SiliconFlow, SambaNova, Groq, Cerebras, Crusoe, DigitalOcean, Phala, Mancer 2, NextBit, Parasail, Venice, Wafer, Morph, Ionstream, AkashML, Makora, Relace, OpenInference, Inceptron | zero (ZDR) | ✓ no training |
| Anthropic | 30 days | ✓ no training |
| OpenAI | unknown duration | ✓ no training |
With data_collection: deny, first-party DeepSeek is excluded (it may train and retains for an unknown duration). Models keep working because every model in the estate’s chains has at least one ZDR endpoint:
| Model | ZDR endpoints |
|---|---|
deepseek/deepseek-v4-flash-0731 (main) |
33 |
openai/gpt-oss-120b (fallback) |
20 |
google/gemma-4-31b-it (fallback) |
15 |
google/gemma-4-26b-a4b-it (fallback) |
7 |
google/gemma-3-12b-it:free (fallback) |
1 |
openai/gpt-5.6-luna (delegation/vision) |
5 |
The ZDR endpoint list is live at https://openrouter.ai/api/v1/endpoints/zdr.
Verification
Section titled “Verification”Live proof recorded 2026-08-29 against deepseek/deepseek-v4-flash-0731:
provider: {"only": ["deepseek"]}→ HTTP 404 (first-party excluded by the account “may train” opt-out).provider: {"only": ["deepseek"], "data_collection": "deny"}→ HTTP 404 “No endpoints found matching your data policy (Paid model training)”.provider: {"data_collection": "deny"}→ HTTP 200 (routed to a ZDR host such as DeepInfra, Novita or SiliconFlow).
The account-level privacy toggle “models may train on paid requests” is also enabled on openrouter.ai as a second layer.
Activation and rollback
Section titled “Activation and rollback”The change took effect in config.yaml; the running hermes-gateway.service must be restarted for live sessions to pick it up (cron and new CLI sessions read it without restart):
systemctl --user restart hermes-gatewayTo disable the filter, remove the provider_routing block (or set data_collection: allow):
hermes config set provider_routing.data_collection allowKnown side effect of the filter: a request pinned to a non-ZDR provider fails with HTTP 404 “No endpoints found matching your data policy” — this is the intended behavior, and the error message points to the privacy settings page.
Limits
Section titled “Limits”Zero retention is not zero externalization: prompt content still transits to a third-party host (a ZDR provider) for inference. The sensitive-content rule from the SOUL (tax, medical, legal, financial documents → ask before sending to an external LLM) stays in force, with ZDR as the accepted default after the ask. The only zero-externalization option is local inference on François’s M1Max (local-llm-routing) — kept as an experimentation tier, not a privacy requirement.