Security overview
What we do to keep your credentials and content safe, stated plainly.
Prompts are not stored
Message bodies pass through in memory only. We record model, token counts, latency and status — never content.
Keys are hashed
API keys are stored as salted hashes. We cannot read your key back, which is why rotation exists.
Credentials encrypted
Prompt and completion bodies are never persisted — only usage metadata is recorded.
Everything audited
Every administrative action is written to an append-only audit log with actor, target and timestamp.
Transport
- TLS on every endpoint. There is no plaintext HTTP entry point.
- HSTS with preload on all web properties.
- Strict security headers: no sniffing, framing restricted, referrer trimmed.
Access control
- Customer keys are scoped to a single account and cannot read anyone else's data.
- Administrative access is guarded by a single secret compared in constant time.
- Inference providers are reached only from the server side; their credentials never reach a browser.
- Failed authentication attempts are rate limited.
Isolation and quota
Quota counters are strongly consistent per account, so one customer's traffic can never consume another's budget. Capacity has guaranteed floors per plan, so a large tenant cannot starve smaller ones completely.
Data retention
| Data | Retention |
|---|---|
| Prompt and output bodies | Not stored |
| Request metadata | 7 / 30 / 90 days by plan |
| Security and audit logs | 90 days |
| Account record | Account life plus 30 days |
Reporting a vulnerability
If you believe you have found a security issue, contact us through the support page with the subject Security report. Please include:
- A description of the issue and its impact.
- Steps to reproduce, ideally minimal.
- Whether any real customer data was accessed.
We acknowledge reports within 3 business days and will keep you updated until resolution. Please do not run automated scanners or load tests against production without written permission, and do not access data that is not yours.
Your responsibilities
- Keep keys server-side and rotate them if exposure is suspected.
- Add authentication to any route of yours that forwards to AuCore.
- Set
max_tokensto bound cost and output size.
See the key security guide for a practical checklist, and our Privacy Policy for data handling detail.