Security at KeyC

We never store prompts

Request bodies stream through the gateway to OpenAI/Anthropic. We persist metadata only: tokens, model, latency, cost, and status.

Provider key vault

Real provider keys are encrypted at rest with AES-256-GCM. The master key lives in your environment (never in the database). Keys are never returned by the API after vaulting.

Virtual keys

Issued as kc-… secrets, stored as SHA-256 hashes only. Shown once at creation. Revocation propagates via Redis pub/sub across gateway replicas in about a second.

Data plane isolation

The gateway authenticates from memory cache and Redis — Postgres is not on the request path. If the control plane is briefly unavailable, in-flight governed traffic can continue from cache.

Redis unavailability uses a documented fail-open for availability; budgets may not enforce until Redis recovers. Contact us for enterprise fail-closed options.

Account security

• Passwords hashed with scrypt
• Signed HTTP-only session cookies
• Email verification for self-serve signups
• Optional TOTP MFA for owners and admins
• Enterprise SSO/SAML on request

Compliance artifacts

DPA & subprocessors · Privacy Policy · Developer privacy notes