> ## Documentation Index > Fetch the complete documentation index at: https://docs.xpander.ai/llms.txt > Use this file to discover all available pages before exploring further. # Policies > License models, API key lifetime, request retention and saved prompt text, for the whole organization. [Policies](https://platform.xpander.ai/governance/policies) (**Platform > AI governance > Policies**) holds the rules for every model call in the organization. Changes reach the LLM Gateway within seconds and are recorded in the [Audit log](https://platform.xpander.ai/governance/audit). To change a setting, select its row or choose **Change setting…**. A role that may only view policies sees **Your role lets you see the policies, not change them.** ## Agents that can send tasks **New agents accept tasks from** is **Any agent** or **No agents**. **Set a group's own default** gives a group its own starting point. When a member's groups disagree, the organization default applies. Owners can still change it per agent ([Who can send tasks](https://docs.xpander.ai/use/agents/channels.md#other-agents)). ## License model Each way of paying for model calls has a switch: | License model | Who pays | | - | - | | **Bring your own subscription** | The person, on their own Claude plan, where xpander has enabled it for your organization. Not billed to you, and counts toward no budget. | | **Bring your own key** | Your organization, on a stored provider key ([Providers and keys](https://docs.xpander.ai/run/llm-gateway/providers-and-keys.md)). The provider bills you. | | **Included with xpander** | xpander's key, billed in credits. xpander cloud only. | The last one that is on can't be turned off and shows **Stays on: calls fall back to it.** **Exceptions** lets groups and agents use fewer license models than the organization. * **Default license model** (when both **Bring your own key** and **Included with xpander** are on): **Bring your own key** uses your stored key when there is one and xpander's key otherwise. **Included with xpander** always uses xpander's key, billed. * **When someone's plan hits its limit** (when **Bring your own subscription** is on): **Fall back to company models** (the default) until the plan resets, or **Pause**, which holds their calls until then. On Hybrid, **Included with xpander** is not offered for anything on your install or your people's computers. Air-Gapped has only **Bring your own key**, so this section does not show. The full order on every call: [Licenses and who pays](https://docs.xpander.ai/run/llm-gateway/which-key-pays.md). ## Key lifetime **Longest lifetime for a new API key** caps the expiry people can give keys in [AI models & keys](https://chat.xpander.ai/?settings=my-gateway): **30 days**, **90 days**, **180 days**, **1 year** or **No limit**. With a cap, the form says *Your organization allows up to ...* and does not offer **Never**. Existing keys keep their expiry. ## Retention **Keep requests for** sets how long [request records](https://docs.xpander.ai/run/llm-gateway/requests-and-costs.md) and their saved text are kept: **30 days**, **90 days**, **180 days**, **1 year**, or **Default** (90 days). Self-hosted installs also offer **No limit**, which applies until you set a period. ## Prompt and response text ![Policies page with the Saved prompt text panel open: All users in the account and a switch per group, all on](https://mintcdn.com/xpanderai-099931d1/H-WYYv839kjeMNSx/images/llm-gateway/08-policies-capture.png?fit=max\&auto=format\&n=H-WYYv839kjeMNSx\&q=85\&s=290711b83ca28c8dcaca23f7474966bf) Saved prompt text: one switch for all users in the account and one per group. Shown with sample data. Usage, cost and timing are always kept. Prompt and response text is saved for everyone by default, including groups added later and people in no group. Saved text can include personal data, so check your privacy obligations. In **Saved prompt text**, turn off **All users in the account** to save no text at all, or turn off a single group's switch. Turning a switch back on asks you to confirm and says how long the text will be kept. Turning one off stops saving from the next call. Text already saved stays until its request is deleted. | | | | - | - | | **Which calls** | Calls by, or agent runs started by, a person in a group with the switch on, or in no group while **All users in the account** is on | | **What is kept** | The prompt (instructions, conversation, names of the skills offered) and the final answer. Never keys, headers, images or files. Anything that looks like a secret is removed, and very long text is cut with a note. | | **Where** | Encrypted with a key unique to your organization, next to its request in your organization's own database | | **Who can read it** | Roles that may view usage, under **Prompt and response** in [Logs](https://platform.xpander.ai/governance/logs). Every opened request is recorded in the [Audit log](https://platform.xpander.ai/governance/audit). | On Hybrid, these switches cover agents in your environment. Coding tools on your people's computers connect to xpander cloud, which never saves their text. ## Accounts When a main account runs several accounts, **License models** and **Saved text** have an **Accounts** row that decides which accounts follow the main account. A main-account setting shows a **set by** badge inside the account. A main account can turn saving off for all of its accounts. ## Next steps > **[See who pays for each call](https://docs.xpander.ai/run/llm-gateway/which-key-pays.md)** > > The order on every call. > **[Read requests and their cost](https://docs.xpander.ai/run/llm-gateway/requests-and-costs.md)** > > What a request record holds. This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.