Security

Security is a continuous process, not a destination. This page describes the technical and organizational measures we have implemented to protect your account, your credit, and your API traffic.

What we are not: We are not SOC 2 audited, not ISO 27001 certified, and not HIPAA compliant. Do not send protected health information, payment card data, or other regulated data through the API.

API keys are bearer credentials. Anyone holding a key can spend your credit. We implement several protections:

• Keys are shown exactly once at creation and never displayed again
• Secrets are never stored in cleartext — only a secure hash is kept
• Keys never appear in logs (automatic redaction)
• Each key has rate limits (60 req/min, 100k tokens/min by default)
• Keys can be revoked instantly from the portal
• All keys draw on a single prepaid balance with a hard cap

What We Store

• Account email and authentication identifiers
• Credit records (append-only for integrity)
• Usage metadata: timestamp, model, token counts, cost
• Signup IP address (for trial credit limits)

What We Do Not Store

• Prompt or response content — not retained by design
• Card numbers or payment data (handled by Stripe)
• Passwords (authentication via third-party provider)
• API key secrets in cleartext

• Hosted on AWS: Database, cache, load balancer, and API run on Amazon Web Services infrastructure
• Encrypted at rest: Database and cache use encryption at rest
• Encrypted in transit: TLS 1.2/1.3 enforced for all connections, with HTTP redirected to HTTPS
• Automated backups: Point-in-time recovery with encrypted backups
• Network isolation: Private subnets for database and sensitive services

Security research on the Service is welcome, within these rules:

• Test only against your own account, keys, and data
• Do not test against another customer or their data
• Do not run denial-of-service or volumetric tests
• Do not attempt to reach upstream providers through us
• If you encounter another customer's data, stop immediately and report it
• Do not publish findings until we have had time to fix them

Report security findings to:

There is no bug bounty program. We commit to responding to legitimate reports and will not pursue legal action against research conducted within these rules.

In the event of a security incident that affects your account or data, we will:

• Notify affected customers as soon as reasonably possible
• Investigate the scope and impact of the incident
• Take remedial action to prevent recurrence
• Comply with applicable breach notification laws

If you believe your account has been compromised:

1. Revoke all API keys immediately from the portal
2. Review recent usage for unauthorized activity
3. Contact us at security@rhodes.ai
4. Create new keys and update your applications

Current status: We are an early-stage product focused on building secure infrastructure. We are not currently pursuing compliance certifications.

Do not send protected health information, payment card data, government identifiers, or other regulated data through the Service.