How Hisoka handles the security of your account, keys, and traffic.
Transport
All traffic is served over TLS 1.2 and 1.3 only. TLS 1.0 and 1.1 are disabled. HSTS is enabled with a one-year max-age.
API keys
Keys are generated with a CSPRNG, prefixed sk-, and stored only as a hash. The plaintext is shown once at creation. Revoking a key takes effect immediately for new requests.
Upstream credentials
Provider and reseller credentials are held server-side and are never exposed to API clients or embedded in responses. Your users only ever hold their own gateway key.
Data isolation
Requests are authenticated against your key and scoped to your account. Usage records, logs, and balance are queried per account; cross-account reads are rejected at the query layer.
Password storage
Passwords are hashed with bcrypt at cost 12. We never store or log plaintext passwords.
Logging
We record request metadata (model, token counts, latency, status) to give you usage analytics and abuse detection. Prompt and completion content is not written to logs by default.
Abuse and rate limits
Requests are rate limited per key. Repeated authentication failures and quota exhaustion attempts are throttled and recorded.
Reporting a vulnerability
If you believe you have found a security issue, email support@hisoka.net with reproduction steps. Please do not open a public issue or test against other users' accounts. We will respond within two business days.