Security and data handling

Inference keys start with sk-. We store a SHA-256 hash of each key for lookup, not the key itself. Each key can carry its own spending budget, rate limit and expiry, and can be revoked at any time from the dashboard.

Management keys (akm-) are a separate credential for the Management API and cannot be used for inference.

For each request we record the model, token counts, cost and timestamp. Request and response logs, including prompt and response content, are kept for 7 days and then deleted. There is no option to keep them longer.

Optional guardrails can mask personal data and block keywords before a request leaves the gateway. See guardrails.

Payment and transaction records are kept separately, as required for tax and accounting.

Your prompts are sent to the model provider you choose, under that provider's terms. Payments are processed by Razorpay; we do not store card or UPI credentials. See the privacy policy.

The site and the API are served over HTTPS.

AICredits does not hold SOC 2, ISO 27001 or similar certifications, and we do not publish an uptime percentage. Live system status is at /status.

Email [email protected] with the subject "Security report" and enough detail to reproduce the issue. Please do not access data that is not yours.