Skip to Content
WikiSecurity

Security

MyTokenGate’s security practices and your responsibilities.

Data Security

Encryption

  • In Transit: All API communications use TLS 1.3 encryption
  • At Rest: Sensitive data encrypted with AES-256
  • Key Storage: API keys hashed with SHA-256

Data Retention

  • Request logs retained for 30 days
  • No prompt/response storage by default
  • Billing data retained per legal requirements

Data Privacy

  • No training on your data
  • We do not sell your data or use it for our own commercial purposes
  • To fulfill your request, we forward it to the upstream model provider you select, subject to that provider’s own privacy terms

API Key Security

Best Practices

  1. Never hardcode keys in source code
  2. Use environment variables for key storage
  3. Rotate keys regularly (recommended: every 90 days)
  4. Use separate keys for different environments
  5. Monitor key usage for anomalies

Key Management

# Good: Environment variable
export MYTOKENGATE_API_KEY="sk-xxx"
 
# Bad: Hardcoded
const apiKey = "sk-xxx"  # Never do this!

Key Scopes

  • Read-only: View account and usage
  • Full access: All API operations
  • Project-specific: Limited to one project

Access Control

Authentication

  • Bearer token authentication
  • JWT for session management
  • Optional IP allowlisting

Authorization

  • Role-based access control (RBAC)
  • Team member permissions
  • API key restrictions

Compliance

Data Handling Practices

  • Data is encrypted with TLS 1.3 in transit and AES-256 at rest for sensitive data
  • Request logs are retained for 30 days by default; prompts and responses are not stored by default
  • Audit logs are exportable to help you meet your own compliance requirements

For a formal compliance review or a Data Processing Agreement (DPA), contact security@mytokengate.com.

Audit Logs

  • All access logged
  • 90-day retention
  • Exportable for compliance

Your Responsibilities

Secure Development

  • Validate and sanitize all inputs
  • Implement proper error handling
  • Use HTTPS for all communications

Monitoring

  • Monitor API usage patterns
  • Set up alerts for anomalies
  • Review audit logs regularly

Incident Response

  • Have a key revocation plan
  • Know how to contact support
  • Document security procedures

Reporting Security Issues

If you discover a security vulnerability, please report it responsibly:

Last updated on
GlossaryEcosystem