Trust
Security at ProtAI
Last updated: 12 October 2026
You trust us with your usage data and your users' balances. Here's plainly how we protect it — what we do, and what we deliberately don't do.
No-proxy architecture
The single biggest security decision we made: ProtAI never sees your AI traffic. Your prompts, completions, and user content go directly to your provider. We meter only the numbers you report — units, balances, timestamps. An attacker can't steal what we never had.
API keys, handled properly
Keys are generated with 192 bits of entropy, stored as SHA-256 hashes (never plaintext), and shown exactly once at creation. Prefixes let you identify keys in the dashboard without exposing them. Revocation is instant.
Encryption everywhere
TLS 1.2+ in transit, AES-256 at rest via our infrastructure providers. Webhook payloads are HMAC-SHA256 signed so your endpoints can verify every delivery genuinely came from us.
Least-privilege data access
Row-level security on every table: your projects, meters, and ledger entries are visible only to your account. Service-role access is limited to the API and background jobs that need it, and every admin action is tied to an authenticated session.
Atomic, auditable metering
Balance deductions run as single atomic database operations with row locking — concurrent requests can't double-spend. Every unit is written to an append-only ledger, so balances are always reconcilable.
Careful dependencies
Small dependency surface, pinned versions, automated security updates. We don't add a package to solve what ten lines of code can do.
What we don't claim
We don't have SOC 2 or ISO 27001 certification — we're a small team and we'd rather be honest than certified-ish. What we have is a minimal-attack-surface architecture, strong defaults, and fast response when something looks wrong. If you need a security questionnaire answered for procurement, ask us — we'll fill it in properly.
Responsible disclosure
Found a vulnerability? Please don't exploit it or disclose it publicly before we've had a chance to fix it. Send details via the contact page (subject: "Report a bug") from an email we can reply to. We aim to acknowledge reports within 2 business days and will keep you updated on the fix. We won't take legal action against good-faith researchers.
Subprocessors
Our infrastructure runs on Supabase (database & auth), Vercel (hosting), Stripe (payments), and Resend (email) — each with their own audited security programs. See the Privacy Policy for details.