Security & Trust
Controls
How Hopper protects customer information, manages access, and operates its infrastructure.
Infrastructure & data flow
Hopper uses AWS and Google Cloud, with a cloud-hosting footprint spanning the United States, European Union, and India. Processing locations depend on the workload and deployment; region requirements are defined for the customer engagement.
For Hopper-hosted open-weight models, inference requests are served on Hopper’s infrastructure rather than sent to external model-provider APIs. Model creators and applicable licenses are identified in model documentation.
Access & engineering practices
Authenticated access
Clerk handles user authentication. Inference APIs authenticate requests using API keys.
Staff access controls
Multi-factor authentication is required for production access. Access is limited according to each person’s role.
Reviewed production changes
Code review happens before production deployment. Secrets are managed outside source code.
Ongoing maintenance
Engineering practices include dependency and vulnerability scanning, security patching, access reviews, and access removal during offboarding.
Hopper processes customer inputs and model outputs to deliver inference. Depending on the service, this includes prompts, text, and audio. Account and usage metadata supports service operations and billing.
Zero data retention by default
Request logging is disabled by default. Under this default configuration, prompts and completions are processed to serve the request and are not retained. Separately enabled logging follows the organization’s settings and applicable agreements.
Training requires your written consent
Hopper does not use customer content to train or fine-tune models without prior written consent. For authorized training on production traces, the agreement defines the approved data, purposes, retention and deletion terms, model rights, and limits on reuse. Permission to log requests does not authorize training.
Read our Privacy Policy for details on content, metadata, and service-specific processing.