Web search in the chat

The chat can call a web search tool so the model can look up current information. Hosted search is built in and billed per search (opt-in); if you run your own search MCP server, you can connect it in chat settings instead.

Hosted web search (Linkup, per-search fee)

  • Enable “Hosted web search” in chat settings (off by default). The model then gets a web_search tool; each search bills a flat fee from your prepaid credits (see the pricing page; the chat settings show the current price).
  • Queries are handled by Linkup, a search API subprocessor. The query travels from your browser to ozeye’s EU infrastructure and then to Linkup, which processes it in the EU under zero data retention: the query is used in memory to produce results and is never stored.
  • Results are returned to your browser and are never stored by ozeye.

Privacy implications of hosted search

  • Your query text leaves ozeye’s servers: it is sent to Linkup, which processes it under its own privacy policy (EU processing, zero data retention, no training).
  • ozeye stores only billing metadata: user, API key, search modality, cost, and timestamp. The query text and the results are never logged, cached, or persisted (ZDR). Audit records contain only the query length, not the query.
  • Linkup is listed as a subprocessor; see the subprocessors page.
  • A self-hosted search MCP server (your own infrastructure) never touches ozeye servers beyond the same-origin proxy you explicitly enable.

Zero Data Retention posture

The ZDR promise covers content that passes through ozeye infrastructure. Hosted search passes only the query (never stored) and billing metadata (stored); results never touch our servers beyond being relayed to your browser.

Hosted search is opt-in and off by default: nothing is ever sent to Linkup unless you enable the setting.

Bringing your own search server (optional)

If you run your own search MCP server (any MCP server exposing a search tool), you can connect it in chat settings → MCP. The ozeye same-origin proxy forwards your browser’s requests to your instance. In production it blocks private/loopback addresses (SSRF guard), so your instance needs a public address, e.g. a subdomain behind your own reverse proxy with TLS. For local development, the proxy can allow loopback/private targets with OZEYE_MCP_PROXY_ALLOW_LOCAL=1. The server typically expects an Authorization: Bearer token of your choice; the proxy forwards it to your instance.

Billing

Hosted search bills a flat per-search fee from your prepaid credits; unsuccessful searches (e.g. the search backend is unavailable) are not billed. A self-hosted search server is free to use: it runs on your infrastructure.