Security & Privacy

Learn how to protect your data — implement API key restrictions, configure IP whitelisting, and review our encryption/compliance practices.

Overview

Treat API keys like passwords. Scope them, rotate them, and keep secrets off client devices. This page covers key controls, network limits, and encryption basics.

Baseline controls

Separate keys per environment
Least-privilege scopes
IP allowlists for production keys
Short-lived keys for contractors when possible

API key restrictions

FAQ

How can I restrict my API key?

Enable API key scopes and IP allowlists to limit usage. Treat your key as a secret and never expose it in frontend code.

Tags: API Key · IP Whitelist

What if a key leaks?

Revoke it immediately in the console
Create a replacement key
Rotate all dependents
Review recent usage for anomalies

Can I limit models per key?

Where supported, bind a key to an allowlist of models or projects so a leaked key cannot call everything.

Encryption & data handling

In transit

All public API traffic should use HTTPS / TLS. Reject cleartext endpoints in production configs.

FAQ

Is my data encrypted?

We use encryption in transit to protect requests. Follow integration best practices (TLS only, secret storage, least privilege) for additional safety.

Tags: Encryption

Do you retain prompts for training?

See your contract and the Zero Data Retention options for your plan. Enterprise terms may differ from default self-serve settings.

How should we handle PII?

Minimize PII in prompts, mask identifiers when possible, and keep retention policies aligned with your compliance team.

Hardening checklist

Control	Owner
Secrets in vault / env — not git	Engineering
IP allowlist on prod keys	Platform
Spend alerts + hard caps	Finance + Eng
Key rotation schedule	Security

Security is layered: a single control failing should not expose the whole system.