Trust
What we have, what we're working on, and what we don't do.
Last updated 25 October 2026. Every change is dated below.
Where Gateway requests go
- Processed in: mainland China, by our upstream provider. Their service is governed by PRC law.
- What Meruva stores: account details, billing records, and usage metadata per request (model, token counts, cost, time). We do not store your prompts or outputs.
- What our upstream stores: they say they keep no request logs, but we haven't yet received written terms we can publish. Until we do, assume your prompts may be retained.
- Training: Meruva never trains on your data.
- Please don't send: personal data, health or financial records, client confidential material, or anything you're not allowed to share with a third-party processor.
- Need data to stay in your jurisdiction? Use Meruva Sovereign.
- Leaving: the API is OpenAI-compatible and the models are open-weight. Change your base URL and go.
- What's next: we plan to add regional processing. We'll announce it here, with dates, before anything changes.
Who controls what
Sovereign| Hardware and location | You. Your servers, or a data centre in your country or chosen region. |
|---|---|
| Model weights | You hold a copy. Open-weight Qwen, DeepSeek, Kimi and more, from official sources, checked against published hashes, with licences listed per model. |
| Prompts and outputs | Stay inside your deployment. The platform doesn't call the model labs or the Meruva Gateway. |
| Encryption keys and identity | Yours, integrated with your directory. |
| Logs and audit | In your environment. Every call traceable to a user, a project and a cost. |
| Updates and new models | You approve them. Connected, or offline with updates delivered by a route you choose. |
| Meruva's access | None by default. Support access is granted by you, time-limited and logged. |
Sub-processors
| Sub-processor | Purpose | Location | Status |
|---|---|---|---|
| Upstream inference provider | Gateway model inference | Mainland China (PRC law) | Planned for launch |
| Stripe | Card payments | To be confirmed | Planned |
| Cloudflare | Website hosting and edge | Global edge | In use for this website |
| Cloud server provider | Gateway application server | London, UK | Planned |
Meruva Sovereign deployments use no Meruva sub-processors for prompts or outputs: they stay in your environment.
Certifications
None yet. Meruva doesn't yet hold ISO 27001, SOC 2 or Cyber Essentials certification, and isn't listed on G-Cloud. If your procurement needs one of these, tell us early and we'll be straight with you about timing.
Changelog
| Date | Change |
|---|---|
| 25 Oct 2026 | Trust page published. Gateway not yet open. |