Skip to main content
Baseten maintains SOC 2 Type II certification and HIPAA compliance. See the Baseten Trust Center for policies and certifications.

​
Data privacy

Baseten does not store model inputs, outputs, or weights by default. This zero data retention (ZDR) policy applies to synchronous inference.
  • Model inputs and outputs: Baseten temporarily stores async inference inputs until processing completes. It does not store outputs.
  • Model weights: Baseten loads weights at deployment from sources such as Hugging Face, GCS, or S3. You can enable weight caching and request permanent deletion of cached weights.
  • KV cache: The attention KV cache remains in GPU memory during inference. Baseten does not persist it to disk and discards it when a replica restarts or scales down.
  • Postgres data tables: Existing users can store data in Baseten’s hosted Postgres tables and delete it at any time.
Baseten’s network accelerator speeds up model downloads. Contact support to disable it.

​
View your compliance policy

If Baseten has set a compliance policy for your account, the policy appears in your Organization and Team settings under the General tab, and on the model environment detail view. The policy shows the boundaries your inference workloads run within:
  • Framework: the compliance programs your workloads are restricted to.
  • Region: the geographic regions where your workloads can run.
Compliance policies are read-only and managed by Baseten. To set or change a policy, contact support.

​
Workload security

Baseten isolates inference workloads to protect customer data and platform infrastructure.
  • Container security:
    • Baseten never shares GPUs across users.
    • Automated controls monitor and mitigate vulnerabilities.
    • Workloads and nodes run with minimal privileges.
  • Network security:
    • Each customer has a dedicated Kubernetes namespace.
    • Calico and Cilium enforce network isolation.
    • Nodes run in a private subnet with firewall protections.
  • Pentesting:
    • Independent security firms conduct annual penetration tests.
    • Baseten tests malicious model deployments in a dedicated production-like environment.

​
Self-hosted model inference

Baseten offers self-hosted deployments for organizations that need control over their inference infrastructure and network boundary. The workload plane runs inside your VPC, while Baseten operates the control plane. Inference requests route directly to your workload plane without passing through Baseten infrastructure. To scope self-hosted inference, talk to us.