Resources
Security & Data Handling
Security & Data Handling
What we expect from your integration and how requests are handled.
Protecting your keys
Keep keys on a server you control, in a secret manager or an environment variable.
Never hardcode a key, and never put one in browser or mobile code.
Use a separate key for each application or environment, so you can revoke one without affecting the rest.
Revoke a key immediately if it may be exposed, then switch your application to a new one.
Monitor each key's activity in Usage & Insights.
How requests are handled
- Send every request over HTTPS.
- The Generate API is stateless: it doesn't keep a conversation between requests. If you want history, you send it with each request.
- Files are sent with the request, base64-encoded, and are subject to the limits on the Files & Documents page. Files that can't be read are refused with an error that says why.
- Every response carries a request id (the X-Request-Id header), so a request can be traced in support without sharing your key or your content.
- Customer-facing responses and the Intelligence Trace never name the underlying models or providers.
Policies
How Aivana handles and retains data is set out in the Terms of Service and the Privacy Policy. If you have a security question or need to report a concern, use the help request at the bottom of any docs page.
Learn more
Managing API Keys
Learn how to create and revoke API keys in Aivana AI Studio.
Quickstart Guide
Get your key and make your first request in minutes.
Try the Playground
Experiment with Aivana MMI — no account or code required.
Still have questions? We are here to help!