Data controls
Review the effective data-handling posture for an organization and its projects.
An effective data-handling posture applies to the organization and each project. A value can come from the default policy, organization policy, project policy, contract, or a compliance override. The posture identifies the source and scope of each value. One setting can be changed in the API Platform; every other value is read-only there.
What the posture describes
| Policy axis | What it describes |
|---|---|
| Request metadata | Whether operational fields such as request id, status, model, operation, timing, and cost attribution can appear in Usage, Logs, filters, and exports. |
| Customer content | Whether customer-provided content can be stored separately from request metadata. |
| Model training | Whether QuiverAI can train its models on inference inputs and outputs. |
| Request detail retention | Whether new request-level detail is retained and for how long it remains available. |
| Historical detail | Whether request detail retained before a policy change remains available. |
Prompts, request bodies, response bodies, uploads, and generated artifacts are not captured alongside request metadata. A request-detail retention window describes supported access, not proof of physical deletion at its boundary. When policy becomes more restrictive, historical detail can be withdrawn immediately or after the policy change finishes applying.
The one manageable setting is Improve QuiverAI, your organization’s own choice for the Model training axis. On lets QuiverAI train its models on inference inputs and outputs. Off stops that training. New organizations start with it on. An Owner or Admin can always turn it off, unless the organization is blocked.
Turning the setting off doesn’t stop storage. The Customer content axis decides whether content is stored, and not storing customer content is never a self-serve choice; it is set through a contract.
- When an approved contract prohibits model training, the setting is turned off and cannot be turned on, including before the contract’s start date.
- A contract’s training restriction stays after the contract ends or is revoked, until QuiverAI support releases it. Under a contract that allows training, an Owner or Admin can turn the setting on.
- While a compliance override prohibits model training, the setting cannot be turned on here, including after you turn it off.
- When a contract or compliance override prohibits customer content storage, nothing is stored to train on. The Model training axis shows not used for training, and the setting cannot be turned on.
- A contract, a compliance override, or a customer content storage prohibition can decide the Model training axis while your organization’s choice is still on. The setting then shows your choice with a note that it is not in effect, and you can still turn it off.
The remaining axes describe the policy in force; they are not editable settings.
Responses API behavior
POST /v1/responses is stateless. Omit store or send store: false. store: true returns 400 invalid_request regardless of organization policy; changing policy cannot enable response storage. There is no stored-response retrieval endpoint.
To continue a conversation, replay the full input history rather than a response ID. Omit previous_response_id or send null; a non-null value also returns 400 invalid_request. See Responses limitations.
These API limitations do not replace the metadata, customer content, and model training policies above. Caller functions run in your application, so any files or other content they store remain your application’s responsibility.
Runtime policy evidence
Successful attributed API requests include response headers that identify the effective policy:
x-quiverai-request-metadata-policyx-quiverai-request-metadata-retention-secondsx-quiverai-payload-capturex-quiverai-inference-data-policy
x-quiverai-inference-data-policy combines the Customer content and Model training axes into one value: allow_storage_and_training when content is stored and used for training, allow_storage_for_benchmarks_only when content is stored but not used for training, and forbid_storage when customer content is not stored.
Record these headers with the request id when your integration needs evidence of the policy applied to a request. Their values describe the effective posture; they do not replace your organization’s contract or compliance requirements.
The former x-quiver-* spellings of these four headers are deprecated. They carry the same values until their planned removal on December 31, 2026. Read the x-quiverai-* names in new integrations.
Open Data Controls
Review effective organization and project policy, retention, provenance, and runtime headers.
Policy can reduce or remove information from Usage and Logs.