Your API keys and account are the keys to your usage and your bill. We design the Service to protect them, and this page lists what we do and what you can do.
What we do
- Encryption in transit. The website, dashboard and API are served over HTTPS only.
- Keys you can control. API keys are shown once when you create them. We store only a one-way fingerprint, so a database leak would not reveal working keys. You can rotate or revoke a key at any time and the change takes effect immediately.
- Passwords. Passwords are stored using salted, memory-hard hashing. Sessions use short-lived tokens, and changing your password signs you out everywhere.
- Abuse protection. Sign-in attempts and invalid key attempts are rate limited, and every account has a request limit.
- Payments. Card details go to our payment partner, Razorpay, and never touch our servers.
- Least data. We keep usage totals rather than the content of your requests, and keep operational logs only for as long as needed.
What you can do
- Call the API from your server, never from a browser or app where the key can be read.
- Keep keys in environment variables or a secrets manager, and out of source control.
- Use a separate key per application and rotate keys when team members leave.
- Use a unique password for your account.
- Watch your usage chart for sudden spikes, which can mean a leaked key.
Reporting a vulnerability
If you find a security problem, please email [email protected] with the subject “Security”. Describe what you found and how to reproduce it. We ask that you:
- give us reasonable time to fix the issue before you disclose it;
- avoid accessing other people’s data, degrading the Service or running automated attacks against production.
We will acknowledge your report, keep you informed and credit you if you wish.