BYOK API Key Security & Data Policy
Last Updated: November 5, 2026
Our Core BYOK Security Pledge
CreatorPilot is engineered with a Zero-Trust architecture regarding third-party credentials. Your secret API keys belong solely to you. We never log, analyze, resell, or expose them.
1. AES-256-GCM Hardware-Grade Encryption
Every stored API key is encrypted at rest using AES-256 with Galois/Counter Mode (GCM). Even in the event of an unauthorized database dump, your credentials cannot be read without the internal server master key kept outside the public root.
2. Never Exposed in Frontend Responses
API keys are never rendered in JavaScript variables, frontend DOM attributes, or AJAX payloads. When viewing your settings, keys are masked to show only prefix and suffix (e.g. AIza...8xY2).
3. Direct Server-to-Provider Communications
When you trigger an AI tool, our server issues an encrypted cURL request directly to the model endpoint (e.g. Google AI Studio at generativelanguage.googleapis.com). The API response is parsed and passed back to your browser immediately.
4. Instant Rotation & Permanent Deletion
You can test, update, or permanently delete your keys with a single click. When deleted, all encrypted records are immediately purged from database storage.