Keeping meeting transcripts private on OpenRouter

Short answer: If you send meeting transcripts through OpenRouter, turn on the privacy settings in your OpenRouter account and add the same two flags to Autorec’s requests with one button. Zero Data Retention limits routing to endpoints that keep nothing, and blocking providers that store inputs for training removes the rest. Leave OpenRouter’s own data-sharing option off. For EU-only processing, point Autorec’s base URL at the EU endpoint. This is how OpenRouter’s documentation describes these settings as of October 2026; they change, so check the links at the end.

Autorec records and transcribes on your machine. The optional AI summary is the one step that sends text elsewhere: the transcript goes to whatever endpoint you configure under Settings, AI Summary. Each request carries your summary prompt, the full transcript, the model name, max_tokens, temperature, and any extra fields you add (more on those below). If that endpoint is OpenRouter, the text is forwarded to a model provider you may never have chosen by name. That is the privacy question. (If you’d rather skip the question, the local LLM post covers running the summary on your own hardware.)

For the OpenRouter setup itself, see Meeting summaries with OpenRouter. This post is only about privacy.

What OpenRouter itself stores

According to OpenRouter’s privacy docs, it does not store your prompts or responses by default. It does store metadata for each request, such as token counts and latency.

There are two opt-ins, both off by default and independent of each other:

• Private Input & Output Logging (Observability settings) keeps your prompts and completions so you can read them in your own logs.
• OpenRouter Use of Inputs/Outputs (Privacy settings) lets OpenRouter use your prompts and completions to improve its product. In return you get a 1% discount on model usage.

I wouldn’t take the discount for confidential calls. Leave both off.

One caveat from the same page: OpenRouter samples a small number of prompts for categorization, which feeds its reporting and model rankings. Unless you have opted in to the use-of-inputs setting, that sample is stored anonymously and is not linked to your account.

The provider is the real question

OpenRouter forwards your request to a model provider, and each provider has its own policy. Some keep prompts for a while. Some may train on them. OpenRouter’s routing docs describe the default as allow: providers that “store user data non-transiently and may train on it” are eligible.

You have two controls for this, and both live in your account’s privacy settings at openrouter.ai/settings/privacy.

Zero Data Retention

With ZDR enabled, OpenRouter only routes to endpoints that have a Zero Data Retention policy, meaning they keep nothing after inference. The settings page has a separate toggle per model group: Anthropic, OpenAI, Google, xAI and “all other models”. Turn on the groups you will actually use, or all of them.

Two things to know:

• Fewer endpoints qualify, so some models may be unavailable or have fewer providers behind them. The docs note that non-ZDR endpoints “may not be available” with ZDR on. Test your model after flipping it.
• ZDR covers inference routing only. Plugins and server tools such as web search have their own retention rules. Autorec doesn’t use them, but it is worth knowing if you reuse the key elsewhere.

Block providers that train on inputs

The other setting disables third-party providers that store inputs for training. It corresponds to data_collection: "deny" in the API: only providers that do not collect user data are used. ZDR is the stricter of the two, but you can switch on both.

Per-request flags in Autorec

OpenRouter accepts the same two controls on each request, in a provider object. Autorec lets you add them. Under Settings, AI Summary there is a textarea called Extra request fields (JSON). Whatever JSON object you put there is merged into the top level of every summary request. With the OpenRouter preset selected, click Use privacy settings and it fills in:

{"provider": {"zdr": true, "data_collection": "deny"}}

You can also paste that yourself. The field saves when you click out of it. You still need your OpenRouter API key in the key field.

What the two flags do, according to OpenRouter’s provider routing docs:

• zdr: true routes the request only to endpoints with a Zero Data Retention policy.
• data_collection: "deny" uses only providers that do not collect user data. The default is "allow".

Autorec validates the field. model, messages and stream are reserved, because Autorec sets them itself; trying to save them gives “Not saved: autorec sets “model” itself.” (with the field name filled in). Anything that is not a JSON object is refused with “Not saved: this isn’t a JSON object.” The field can override max_tokens and temperature, so don’t put them there unless you mean to.

Keep the account settings on too

I’d still switch on the account-wide settings from the previous section. A request-level zdr only adds enforcement. OpenRouter combines it with your account and guardrail settings, so it can never loosen them. The account settings also cover every other app that uses your key, and they are the backstop if you clear the field by accident or paste a typo into it. Treat the per-request flags as a second layer, not a replacement.

Guardrails, if you have a team

OpenRouter guardrails are rules you assign to API keys or organization members. They can enforce ZDR per model group, restrict which providers and models are allowed, and limit which regional domains a key may use. A guardrail enforces nothing until it is assigned, and when several apply, the stricter result wins.

For one person with one key, the account settings are enough. If several people share an organization, create a key just for Autorec and give it a guardrail, so the protection does not depend on everyone’s personal settings.

EU-only processing

If your calls involve EU data, OpenRouter offers in-region routing. You use it by changing the base URL, with no toggle to enable:

https://eu.openrouter.ai/api/v1

In Autorec, open Settings, AI Summary, pick OpenRouter as the provider and edit the API Base URL field. It is a normal text field, so you can overwrite the preset. Your API key and model IDs stay the same.

What the docs say about it:

• Plans. It is available on OpenRouter’s Business and Enterprise plans. Business can be upgraded to self-serve under Settings, Manage plan.
• It fails closed. Requests on the EU domain only go to providers in the region (the EU/EEA, the UK and Switzerland). If none can serve your model, you get an error, not a silent fallback to another region. The EU catalog is a subset of the global one.
• Not everything stays in the EU. Account data, billing records, authentication data, security logs and abuse-monitoring metadata may still be processed in the US.
• The DPA. OpenRouter offers a GDPR data processing agreement with Standard Contractual Clauses. An EU-only processing addendum for API payloads exists, but it applies only if you elect it in writing. It is not automatic.
• Pair it with ZDR. The docs recommend using regional routing together with Zero Data Retention. Region controls where processing happens. ZDR controls whether anything is kept.
• Enforcement. A guardrail’s allowed data regions setting can reject requests that arrive through the wrong domain.

Regional routing doesn’t move your own cloud accounts, either. If you bring your own keys for Bedrock, Azure or Vertex, those deployments have to be in the right region. The GDPR post goes through the wider compliance picture, including what a DPA does and doesn’t cover.

Checklist

1. In OpenRouter, open Settings, Privacy and enable ZDR for each model group you use.
2. In the same place, disable providers that store inputs for training.
3. Leave OpenRouter Use of Inputs/Outputs off (the 1% discount) and Private Input & Output Logging off.
4. In Autorec, open Settings, AI Summary, choose OpenRouter and click Use privacy settings under Extra request fields.
5. Optional, for EU work: on a Business or Enterprise plan, change Autorec’s API Base URL to https://eu.openrouter.ai/api/v1 and, if you can, add a data-region guardrail.
6. For teams: make a dedicated key for Autorec and assign it a guardrail.
7. Run a test summary on a throwaway recording. If it errors with a “no endpoints” message, your model has no ZDR (or in-region) provider. Pick another model.

What this does not fix

These settings rest on promises from several companies. ZDR depends on providers declaring their policy accurately, and your transcript still crosses the network to someone else’s servers. If “kept nothing” isn’t good enough for a given call, summarise it locally or skip the summary. The transcript is a plain text file on your disk either way, and the summary step is optional.

Sources, checked October 2026: OpenRouter docs on data collection and logging, Zero Data Retention, provider selection, in-region routing and guardrails.