Data & privacy
AIx is built for code, which is often proprietary. The system is designed to keep as little as possible.
Zero prompt retention
We do not store your prompts or completions. The durable usage record (api_usage) holds
only:
- the model and kind (chat / embeddings / image / tts / audio),
- token counts and units (images, audio seconds),
- the cost and a timestamp.
No message content, no request bodies, no responses. The usage breakdown the dashboard shows is aggregated from exactly these columns.
Your prompt is, of course, sent to the upstream provider that serves the call for the duration of that request. That provider’s data policy applies to that hop — choose models accordingly for sensitive workloads. AIx itself adds no retention on top.
Keys are hashed at rest
API keys are stored as a SHA-256 hash, never in plaintext. A database leak therefore never exposes a usable, credit-bearing key. Logs only ever contain a short 8-byte fingerprint of the hash, never the key itself.
What we do store
| Data | Why |
|---|---|
Credit balance (api_keys.total_credits) | Billing source of truth. |
Itemized usage (api_usage) | Per-call model/tokens/cost — no content. |
| Billing reconciliation rows | Unsettled refund/charge discrepancies. |
| Key hash, status, expiry, last-used | Auth and lifecycle. |
Moderation posture
The content block-list is empty by default — aggressive moderation breaks legitimate
coding (security tooling, parsers, exploit explainers in CTF/education contexts). Input
sanitisation only strips NUL bytes and trims whitespace; it deliberately preserves
backticks, $, angle brackets and other characters that matter in source code. Operators can
add specific block-terms via policy if a deployment requires it. See
Acceptable use for prohibited-use handling.
Payment integrity
Payment-gateway webhook signatures (Razorpay / PayPal) are verified with a constant-time comparison, so signature validation can’t be probed byte-by-byte via timing.
Your controls
- Scoped keys — limit a key to specific models/kinds and set daily/monthly spend caps and TPM, so a leaked key has a bounded blast radius. See Limits, caps & scopes.
- Key rotation — revoke and reissue keys from the dashboard at any time; revoked keys stop billing immediately.