Security

Last updated: August 2026

1. Transport Security

All API traffic is served over HTTPS with TLS. Plain HTTP requests are not accepted by the API. Certificates are rotated automatically before expiry.

2. API Keys

Every customer receives dedicated API keys. A key is displayed once at creation and is never shown again. Keys are delivered through secure channels only, are never accepted in URL parameters, and are masked in all logs.

3. Access Control

Permissions are enforced per key: each key can be scoped to specific models and carries its own rate limits (requests per minute, tokens per minute and concurrency). Requests outside a key's scope are rejected. IP allowlists can be configured per agreement to restrict a key to your egress addresses.

4. Key Rotation

Keys can be rotated at any time on request. Rotation issues a new key first, lets you switch traffic over, and then blocks the old key - no downtime. If you suspect a key has been exposed, contact us and we will rotate it immediately.

5. Data Handling

We do not log the content of prompts or completions by default - only request metadata (timestamps, model, token counts, status codes) is retained for operations and billing. Data retention and processing follow your signed service agreement.

6. Security Incidents

Reports of security vulnerabilities or suspected incidents are acknowledged promptly and handled by the on-call engineering team. Customer notification for confirmed incidents follows the commitments in your service agreement. Suspected credential exposure is treated as priority: affected keys are blocked first and investigated after.

7. Contact

Security reports: security@iteracompute.com