Are Your Requests Logged at Noxery?

A plain explanation of what is and isn't stored for API and agent usage, with evidence from real records.

The Noxery API is used not only for simple API calls but also through CLI and agent applications. Since these tools can be granted broad permissions such as terminal or file access, we understand you may wonder whether content sent to the model is stored on our side.

This post plainly explains what is and isn't stored on our systems. The screenshots below are real records of a fake request created for testing; no real user data was used.

What do we keep?

Request time
Model used
Input, output and total token counts
One usage row per request (limits are computed from these)
On errors: error code plus shortened, masked error text
Rate-limit counters

What don't we keep?

Prompt / message content
Request body
Persistent copies of files sent via an agent
Content logs of terminal output
API keys in plain text

We don't claim “no data at all”: the technical metrics above are kept for limits and quotas.

If you use an agent or CLI

Permissions you grant an agent are not the same as the Noxery API's permissions. Giving a CLI/agent terminal or file access grants it to that application; the Noxery API cannot reach your computer on its own. But if the agent reads a file and sends it to the model, that content becomes part of the API request.

Don't send critical data such as “.env” files, private keys, passwords, access tokens or session credentials to an agent or model unnecessarily.

How did we verify this?

We sent a fake test request created only for this announcement and checked the request's usage records on Noxery's side. The images below are real records of this test request, cleared of sensitive information.

Admin panel — the test request's usage record shows technical metrics such as model, token count and time; prompt content is not kept in this usage record.

Database — the same test request's usage row holds technical usage metrics instead of content.

What gets written to the database for an API request?

The table below comes from the real usage records of two test requests we sent only for this announcement:

Time	Model	Input Tokens	Output Tokens	Total Tokens	Mode
2026-09-10 15:08:48	qwen-turbo	36	20	56	sync
2026-09-10 15:08:48	qwen-turbo	12	10	22	stream

The rows above are taken from the real usage records of test requests created only for this announcement. Identifying fields related to the user, API key and infrastructure are hidden for security.

There is no field in the usage records that stores prompts, message content or request bodies.

How is data protected?

API/agent usage and web chat are protected differently.

Web chat: So we can show your history back to you, message contents and chat titles are stored encrypted in reversible form. Encryption uses AES-256-GCM with a random nonce per record plus integrity verification. Data is designed to be decryptable only by the application when needed; the encryption key itself is stored neither in the database nor on the frontend side.

API keys: Keys are not encrypted like web chat. The raw API key is never stored in the database; a one-way SHA-256 digest is kept for verification. The original key cannot be recovered from this value. The raw key is shown to the user only at the moment it is created.

In short

The technical usage metrics needed to run Noxery and compute usage limits are kept. Prompts and message content you send via the API are not stored as persistent usage logs on our side.

If you grant an agent broad system permissions, we recommend giving it only what it needs — regardless of the API you use — and not sending critical information to the model.