Most teams clear the technical step first. The request works, the latency is acceptable, and someone has already sketched the integration. Then legal or the security reviewer asks a simple question that stalls the project for a week: where does the prompt go, and who can see it later?

That review is not optional, and it should not depend on a sales call. Here is the checklist I would run against any OpenAI-compatible API provider, with WebWright's published answers where they exist. Every answer links to the page it came from.

The eight questions

1. Is prompt and response content stored, logged, or used for training? This is the first question, because it decides how much of the rest matters. WebWright's Privacy Policy states that the content of API prompts and responses is not collected or stored, that chat history is not retained, and that Input and Output are not used to train models (sections 2.5, 4.1, 4.2).

2. What metadata is collected, and for how long? Content and metadata are different. WebWright collects usage metadata: token consumption, account tier, error logs, timestamps, request frequency, and IP and device information (section 2.2). Retention is published: error logs up to 90 days, usage data up to 3 years, and account information while the account is active plus up to 90 days after deletion (section 7).

3. Who else processes the request? WebWright's policy states that requests are processed by upstream AI infrastructure, which may temporarily process a request to generate a response, and it names Stripe, upstream AI providers, cloud infrastructure, and analytics as service providers that are contractually bound to use information only to provide the service (sections 4.4, 5.1).

4. How are API keys handled? API keys are stored as cryptographic hashes and cannot be retrieved after issue; if a key is lost, a new one is generated (section 8.2). The policy also lists secure API key management among its security measures (section 8.1).

5. What encryption applies in transit and at rest? The published security section lists TLS/HTTPS encryption in transit and encryption at rest (section 8.1).

6. Is data sold or shared for advertising? The policy states that personal information is not sold, rented, or traded, and is not shared with advertisers for targeted advertising (section 5.5).

7. What rights and regions are covered, and how are they exercised? CCPA and CPRA rights are described, including the right to know, delete, and correct, with requests sent to privacy@webwright.ai (section 6).

8. What happens on a breach? The policy states that affected users are notified in accordance with applicable law, with details about the breach and steps they can take (section 8.4).

How to use the checklist

Ask each question in writing and keep the answer with its source. A provider that answers clearly and cites a public page has done the hard part already. A provider that answers only in a call, or that cannot point to a page, is telling you something about the review that will follow.

One more thing worth deciding early: which data you will send at all. If your product can avoid putting raw customer content in a prompt, the review gets shorter for every provider you evaluate, not just this one.

If you are working through this review now, the fastest path is a short working session. Bring the use case and the data you plan to send, and we will map it to the published data-handling answers and a first integration step.

Sources

The WebWright Team