Security

Encryption at rest

API keys are encrypted with AES-256-GCM using a vault key derived via HKDF-SHA256. The master encryption key (VAULT_ENCRYPTION_KEY) lives only in server environment variables — never in the database.

Each ciphertext includes a random 96-bit IV. Plaintext keys are not logged, cached, or returned to clients after the initial vault request.

Transport & sessions

All traffic uses HTTPS. Authentication is handled by Supabase Auth with HTTP-only session cookies. Dashboard routes are protected by middleware; API routes require a valid session or personal API token.

Database isolation

Postgres Row-Level Security ensures each user can only read their own rows. Team vault keys use separate policies scoped to team membership. The Supabase service role is used only for Stripe webhooks and cron jobs where no user session exists.

Spend sync

When syncing spend, keys are decrypted server-side in memory, used once to call the provider billing API, then discarded. Only aggregated cost and token metrics are persisted — never raw API responses containing secrets.

API tokens & webhooks

Personal API tokens and webhook signing secrets are stored as salted hashes. Only prefixes are shown in the UI. Regenerating a token or webhook invalidates the previous secret immediately. Outbound webhooks use HMAC-SHA256 in the X-LLMLocker-Signature header.

Two-factor authentication

Optional TOTP 2FA is available under Settings → Security. When enabled, password sign-in requires a code from your authenticator app.

Downgrades & locked keys

If you downgrade from Pro to Free with more than 3 keys, excess keys are marked locked (not deleted). Upgrade again to unlock. Free plan also limits you to 2 distinct providers.

Responsible disclosure

Report security issues to the contact address on our website. We aim to acknowledge reports within 48 hours.