Sensitive data¶

This page is the operational companion to Architecture → Privacy. It explains what to do — and what not to do — when handling private code, customer data, or other sensitive content with the gateway.

What counts as sensitive¶

Anything you would not paste into a public chat with a stranger on the internet. Concretely:

Internal source code.
Customer data, support tickets, or internal documents.
Production configuration (with or without secrets).
Anything containing PII.
Anything containing API keys, passwords, or other credentials — even if you intend to strip them; mistakes happen.

When in doubt, treat the content as sensitive.

What you must never send to a free model¶

The Nemotron 3 Ultra free endpoint on OpenRouter explicitly warns against confidential or personal data. The gateway treats this as a hard architectural boundary:

A force-free request that violates privacy policy must fail closed.

In practice:

smart-router-free on sensitive=true → HTTP 403.
X-Scout: true on sensitive=true → HTTP 403.
A SUMMARIZE / CLASSIFY / PUBLIC_REVIEW task with sensitive=true resolved to Nemotron → HTTP 403.

The error body is the same in all three cases:

{"detail": "A force-free request that violates privacy policy must fail closed."}

How to send private repository work¶

Use the default router and leave sensitive at its default:

curl -sS "$BASE/v1/chat/completions" \
  -H "Authorization: Bearer $KEY" \
  -H "Content-Type: application/json" \
  -d '{
        "model": "smart-router",
        "messages": [{"role": "user", "content": "<private code>"}],
        "metadata": {"sensitive": true}
      }'

Or, equivalently, omit the metadata field — sensitive=true is the default.

How to send public open-source work¶

For public open-source code you own, public documentation, or benchmark prompts, you can opt in to free-tier eligibility by setting sensitive=false:

curl -sS "$BASE/v1/chat/completions" \
  -H "Authorization: Bearer $KEY" \
  -H "Content-Type: application/json" \
  -d '{
        "model": "smart-router",
        "messages": [{"role": "user", "content": "<public code>"}],
        "metadata": {"sensitive": false}
      }'

This is the only safe way to use the free model.

What the privacy gate catches¶

The privacy gate in src/smart_gateway/privacy_gate.py scans message content for likely credentials:

Pattern	Behavior
AWS access key (`AKIA[A-Z0-9]{16}`)	Redacted + sensitive upgrade.
GitHub token (`gh[pousr]_…{36}`)	Redacted + sensitive upgrade.
Private key block	Redacted + sensitive upgrade.

These are heuristics, not a complete DLP. Treat them as "last-line-of-defense" patterns, not as a guarantee.

If the gate detects a secret in a request that was marked sensitive=false, it silently upgrades the request to sensitive=true and forwards the redacted version to OpenRouter.

What the privacy gate does not catch¶

API keys for non-AWS, non-GitHub providers.
Database connection strings.
Cryptographic keys in non-PEM formats.
Proprietary data with no detectable pattern.

You are responsible for not pasting secrets into prompts. The privacy gate is a safety net, not a primary control.

What is logged¶

The gateway never logs message content. The structured log lines contain only:

the routing decision (action, model, cause),
the task ID (or _fallback suffix),
the OpenRouter completion ID,
the HTTP status and timestamps.

If you need to share a log snippet with someone, the chat content is already excluded. Do not paste your chat content into the gateway's audit trail in any form; the gateway will silently upgrade the paste to sensitive=true.

Recommendations for clients¶

Treat every coding-session message as sensitive=true by default. Set it to false only when you are sure the content is safe for a free public model.
Do not paste raw API keys into prompts. Use environment variables, secret managers, or paste placeholders like <API_KEY> and replace them in your client before sending.
For agents that run tools (Aider, Cline, Roo-Code), the tool output goes through the same privacy gate as user input.
If you suspect a leak, stop traffic, rotate keys, and audit the structured logs for unexpected traffic.