Is OpenRouter Safe? Privacy, Logging and ZDR in 2026

Is OpenRouter safe? See what it logs, how zero data retention works, and when to go direct, plus free credits tracked by AI Perks at getaiperks.com.

Is OpenRouter SafeOpenRouter PrivacyOpenRouter ZDROpenRouter LoggingOpenRouterAI Perks
Andrew
Andrew
AI Perks Team
10,903•

Quick Answer

For most workloads, yes. OpenRouter logs basic request metadata, keeps prompt retention opt-in, and says it does not train on your data. Privacy still depends on the model provider behind each request, so use zero data retention for sensitive prompts. Free credits are listed at getaiperks.com.

AI Perks

AI Perks curates and provides access to exclusive discounts, credits, and deals on AI tools, cloud services, and APIs to help startups and developers save money.

AI Perks Cards

Is OpenRouter safe to use?

Yes for most workloads: OpenRouter logs only basic metadata by default, keeps prompt retention opt-in, and says it does not train on your data. It is not an absolute guarantee, because privacy also depends on the model provider behind each request.

The easiest way to test that yourself is with credits you did not pay for. Up to $3,000 in OpenRouter credits is the headline value in the catalogue, and the card shows who qualifies and how to claim.


Top AI Credits for Startups

Apply directly through these verified programs.

What does OpenRouter log and store?

By default OpenRouter says, "We log basic request metadata (timestamps, model used, token counts)." That metadata does not include the content of your prompts or responses, only information about the request itself.

Some storage exists outside that default:

  • Chatroom conversations are stored locally on your device and do not sync across devices.
  • Uploaded files are kept until you delete them or close your account.
  • Batch and large-volume requests need temporary storage of your content so they can be processed.
  • Inputs are screened for known CSAM and malware with automated detection tools.

Retention periods vary by feature and are set in feature documentation. A single global number is not published, so check the docs for any feature you rely on.


Does OpenRouter train on your prompts?

OpenRouter states: "We do not train on your data." It also says any prompt retention is always opt-in, and that it has never shared, sold or licensed underlying prompt data to a third party.

Letting OpenRouter use your inputs and outputs is off by default and earns a 1% discount on model usage. The terms behind that switch are broad: opting in also turns on chat logging, and the licence lets OpenRouter license or sell your content in anonymized form. Leave it off for client work, proprietary code or personal data.


Top AI Credits for Startups

Apply directly through these verified programs.

What are the real limits on that promise?

The model provider is the weak link, and OpenRouter says so itself. It works with providers to ensure prompts are not logged or used for training "when possible", and it has opted out of training only "where possible".

The terms add that some models may store or train on inputs, and OpenRouter makes no warranty about any provider's data handling. So "safe" means safe when you pick endpoints with the right data policy, not safe automatically.


How does zero data retention (ZDR) work on OpenRouter?

OpenRouter says Zero Data Retention routing is available on every plan, and provider-side retention can be disabled for the account or per request. Data policy-based routing, which filters by provider policies, depends on your plan.

FeatureWhere it is available
ZDR routingEvery plan
Data policy-based routingStandard, Business, Enterprise (not Free)
In-region (EU) routingBusiness and Enterprise
Identity-provider tokens instead of long-lived keysBusiness and Enterprise
Private EndpointsEnterprise add-on only
SSO (SAML) and SCIMEnterprise only

Org admins configure logging, ZDR and training settings for their users, so one admin setting can override an individual's preference.

ZDR edge cases worth knowing

  • BYOK does not bypass your restrictions. A bring-your-own-key does not exempt a provider from your data collection settings.
  • Declarations are not verified. The ZDR declaration is your statement about your own provider agreement, and OpenRouter does not check it.
  • Video endpoints always count as retaining, even under ZDR.

For EU needs, requests to eu.openrouter.ai are decrypted in the EU and routed only to European shared endpoints. Account and billing data may still be processed in the US.


Top AI Credits for Startups

Apply directly through these verified programs.

How safe are your account and API keys?

BYOK provider keys are stored encrypted. The bigger risk is your own key hygiene, because you are responsible for all activity and charges under your account or API credentials, authorized or not, unless OpenRouter breached its terms.

Each API key can carry its own credit cap inside a workspace, so a leaked key has a ceiling on damage. OpenRouter charges no markup on inference, and its fee applies when you buy credits: 5.5% on Standard and 8% on Business. Promo credits have no cash value and cannot be refunded or exchanged.


When should you go direct to the vendor instead?

Go direct when the data agreement matters more than the convenience of one API. A direct contract removes one hop and one set of terms, and large vendor credits can make that route effectively free for a long time.

CompanyFree creditsHow to get
OpenRouterUp to $3,000Get this perk
Anthropic API$20,000Get this perk
Claude via partnersUp to $100,000Get this perk
Google Cloud (Vertex AI, Gemini)$350,000Get this perk
AWS (Amazon Bedrock)$300,000Get this perk
Azure OpenAI$150,000Get this perk
Together AIUp to $50,000Get this perk
CerebrasUp to $22,500Get this perk
Mistral AI$10,000Get this perk
OpenAI API$1,200Get this perk

Total across these ten cards: up to $1,006,700 in free credits ($3,000 + $20,000 + $100,000 + $350,000 + $300,000 + $150,000 + $50,000 + $22,500 + $10,000 + $1,200).

If you are weighing gateways rather than vendors, see OpenRouter vs LiteLLM vs Portkey.


Top AI Credits for Startups

Apply directly through these verified programs.

How do you use OpenRouter safely, step by step?

Step 1: Get credits through AI Perks. Open the OpenRouter card or browse the full catalogue at getaiperks.com, and start the trial there.

Step 2: Keep prompt logging off. It is off by default, and the 1% discount is not worth the licence it grants on sensitive work.

Step 3: Turn on ZDR and data policy filters. ZDR routing is on every plan, while data policy-based routing needs Standard or above. Read each provider's policy before sending anything private.

Step 4: Cap every key. Give each API key its own credit cap, and use separate keys per project.

Step 5: Avoid video endpoints for sensitive data. They are always treated as retaining.

Step 6: Compare direct pricing. If you use one vendor heavily, check whether its own credits make direct cheaper. The free OpenRouter credits guide covers the BYOK side.


FAQ

Does OpenRouter store my prompts?

Not by default. It logs basic metadata such as timestamps, model used and token counts, not prompt or response content, and prompt retention is opt-in. Exceptions include uploaded files, which stay until you delete them, and batch requests, which need temporary storage. Browse getaiperks.com for credits to test this on.

What is OpenRouter zero data retention?

ZDR routing sends requests only to endpoints that do not retain prompts. OpenRouter says it is available on every plan, and provider-side retention can be disabled per account or per request. Video endpoints are always treated as retaining, and OpenRouter offers no warranty on provider practices, so check each provider's policy.

Can OpenRouter sell my data?

OpenRouter says it has never shared, sold or licensed prompt data to third parties. But if you opt into prompt logging, the terms let it license or sell your content in anonymized form. Keep that setting off. The 1% discount is the only reward, and credits at getaiperks.com save more.

Is OpenRouter safe for company or EU data?

Business and Enterprise plans add in-region routing, and eu.openrouter.ai requests are decrypted in the EU and sent only to European shared endpoints. Account and billing data may still be processed in the US. Enterprise adds SSO and Private Endpoints. Compare direct options like Google Cloud credits if residency is strict.

Is it safer to go direct to Anthropic, Google or AWS?

It removes one intermediary and puts you under that vendor's own agreement, which many teams prefer. It is also often cheaper while credits last. Open the AWS card to see the amount and how to claim, then compare it with the OpenRouter route before you commit.


Top AI Credits for Startups

Apply directly through these verified programs.

Start testing with free credits

OpenRouter is reasonably safe when you keep logging off, use ZDR routing and cap your keys. Free credits let you verify that before you commit budget.

Get free AI credits at getaiperks.com →

Every perk card, amount and update is tracked by the AI Perks team at getaiperks.com.

AI Perks

AI Perks curates and provides access to exclusive discounts, credits, and deals on AI tools, cloud services, and APIs to help startups and developers save money.

AI Perks Cards

This content is for informational purposes only and may contain inaccuracies. Credit programs, amounts, and eligibility requirements change frequently. Always verify details directly with the provider.