Security and data handling

• Provider keys are encrypted with AES-256-GCM, bound to your org so they can’t be moved to another, and decrypted only in the router’s memory to call that provider for your org’s requests. They are never returned (only their last four characters) and never logged.
• API keys are shown once. The router stores only a SHA-256 hash of each, and the first characters, so you can tell them apart.
• Everything is served over TLS, and the dashboard’s actions are protected against cross-site requests.

• Each sentence that isn’t cached goes to the provider your request names, with your key, on your account. A sentence served from the cache reaches no provider.
• The cache stores the provider’s audio under a one-way hash of the sentence and its settings, one object per sentence under your org’s own prefix. The text itself is never stored. Orgs never share cached audio.
• Cached audio is deleted by your org’s retention; set it to off to cache nothing.
• Your text and audio are never used to train models, and never sold.
• What the provider keeps is between you and the provider. With ElevenLabs, enable_logging=False asks for its zero-retention mode (enterprise accounts).

The router’s logs and metrics never contain sentence text, provider keys or API keys. They record your org, the provider and model, lengths, timings, errors and IP addresses. The router enforces this in its types: text and keys print only their length or a redaction.

• The router, your account and org data, and logs: DigitalOcean, Bengaluru, India.
• Cached audio: DigitalOcean Spaces, Singapore.
• Synthesis: Sarvam and Raya in India; ElevenLabs in the regions it operates.

• Delete an API key or a provider key in the dashboard; it stops working within a few seconds.
• Lower your retention, or turn it off, to delete cached audio within about a day or two.
• To delete your account, org, keys and cached audio, write to [email protected].

The privacy policy is the full statement. The code is open source, so each of these is checkable. To report a vulnerability, write to [email protected].