Compliance & privacy

Last updated: June 29, 2026

Geek Hub is AI infrastructure for teams moving regulated data. This page summarizes the legal and technical frameworks we comply with and how each one affects you when building on top of our API.

1. GDPR · General Data Protection Regulation (EU)

When your product processes data from EU residents, GDPR applies even if your company is not in the EU. Geek Hub acts as a processor of the data you send us as the controller.

  • Legal basis: we execute a Data Processing Agreement (DPA) on request. Email legal@geekhub.mx.
  • Data residency: we choose EU-based providers where possible. Per-model processing countries are in the DPA or on request at legal@geekhub.mx.
  • Data subject rights: customers respond to their end users; we respond for account data (access, rectification, erasure, portability).
  • Sub-processors: Anthropic, OpenAI, Google, fal.ai, xAI, DeepSeek, Moonshot, Supabase, Stripe, Resend. Full and current list in the DPA.

2. CCPA · California Consumer Privacy Act

If your product serves California residents, CCPA (and the 2023 CPRA amendment) requires you to disclose what personal information you collect, with whom you share it, and to grant access and deletion rights.

  • We do not sell personal information in the sense of CCPA §1798.140(t). Data you send to the API is only processed to respond to your request.
  • Right to deletion: request logs are retained 90 days for audit then anonymized. Upon request we can delete them earlier for a specific account.
  • Tracking opt-out: we honor Global Privacy Control and Do Not Track signals on the website. The API uses no cookies.

3. Zero Data Retention with model providers

When you enable ZDR in your Guardrails, Geek Hub only routes your request to models whose provider confirms no retention of inputs or outputs beyond the time needed to respond.

  • Anthropic: ZDR available under enterprise agreement.
  • OpenAI: ZDR available by enabling store: false and under enterprise account.
  • Google (Gemini): ZDR via Vertex AI with customer-managed retention set to 0.
  • Other providers: we verify their terms before including them. If your Guardrail requires ZDR for a group, the gateway will never route to a non-certified model.

4. Technical security

  • TLS 1.3 enforced on all API communication.
  • API keys hashed with bcrypt; only the prefix is readable in logs.
  • Postgres with Row Level Security to isolate data across organizations.
  • Self-hosted infrastructure on dedicated VPS (no shared-memory edge functions) to reduce attack surface.
  • Encrypted nightly backups with 30-day retention.

5. Current sub-processors

  • Anthropic — Claude inference
  • OpenAI — GPT + DALL-E + TTS inference
  • Google — Gemini + Imagen + Veo inference
  • fal.ai — Flux + Recraft + video inference
  • xAI / DeepSeek / Moonshot — LLM inference
  • Supabase — auth + database (self-hosted on our VPS)
  • Stripe — payments (PCI DSS Level 1)
  • Resend — transactional emails

6. Contact

Compliance questions: legal@geekhub.mx.
DPO / privacy officer requests: datos@geekhub.mx.
Security incidents: security@geekhub.mx.