Security
Security: how your key, money and data are protected.
How keys are stored, what is encrypted, how you sign in and pay, what the logs hold and where it all runs. We don’t hold SOC 2, ISO 27001 or HIPAA certification, and we don’t claim to. This page lists what we do instead, in terms you can check.
Zero data retention
Prompts and outputs are not stored.
AI Runtime holds request content in memory only while the request runs, and keeps the billing record. Providers process requests under their own terms.
What that covers, and the exceptionsAPI keys
- Keys start with rk_ and are 256-bit random secrets.
- We store only a SHA-256 digest of each key, so nobody at Gridheap can read it back.
- Your key is shown once, right after payment. Until then it is sealed with AES-256-GCM, and the sealed copy is deleted on first view or after 24 hours.
- Lost a key? Turn it off and get a new one from your Profile. Your balance stays the same.
Encryption
- In transit: TLS 1.2 or newer (TLS 1.3 preferred), with HSTS.
- At rest: the database runs on AWS RDS, encrypted with a customer-managed AWS KMS key, and requires TLS for every connection.
- Secrets live in AWS Secrets Manager; disks are encrypted; object storage uses AES-256 server-side encryption.
Sign-in
- You sign in with a Gridheap Account (AWS Cognito), using OpenID Connect with PKCE.
- Session cookies are __Host- prefixed, Secure, HttpOnly and SameSite.
Payments
- You pay on Stripe Checkout (card) or PayPal, on their own pages.
- We never see or store card numbers.
Logs
- Application logs hold ids, codes and timings only, never request or response bodies.
- Logs are kept for 7 days.
- Error reports (Sentry) have messages, URLs, headers and bodies stripped before they leave our servers.
Hosting
- AI Runtime, the API your key calls, runs on AWS in us-east-1 (N. Virginia).
- This site and its checkout API run on RShift Sites, on AWS. Cloudflare provides DNS and the network edge.
- Fonts come from Adobe Fonts, except in the EU, UK and Switzerland, where a self-hosted typeface is used instead.
Report a vulnerability
Write to the security team with what you found and how to reproduce it. Please give us a reasonable time to fix it before you publish, and don’t access other people’s data or degrade the service while testing.
The legal documents
- Privacy Policy the legal text, in the Gridheap Legal Center
- Subprocessors every company that processes data for Tokens.Pay
- Terms including refunds and acceptable use
Last reviewed 2026-11-07.
Add credit, get your key.
From $5, plus a 5% top-up fee (minimum $0.79). No subscription; paid credit never expires.
Add credit