Keys are stored as hashes
An API key is shown once, at creation. Only a SHA-256 hash is persisted, so a database dump cannot be turned back into working credentials. Comparison is constant time.
Security
A gateway sees everything, so it should keep almost nothing
Openbase sits between your application and every model provider. That position demands a narrow blast radius: strong secret handling, minimal retention, and a clear record of every privileged action.
Provider credentials are encrypted at rest
The upstream keys that let us reach OpenAI, Anthropic, Google, xAI and DeepSeek are encrypted with AES-256-GCM under a key held outside the database, and are decrypted only in memory to sign a request.
Prompts are not retained
Message content is relayed to the provider you selected and is not written to our storage. What we keep is the metadata needed to bill and debug: model, provider, token counts, latency and status.
No training on your data
Openbase never uses your prompts or completions to train anything, and never sells or shares them. Provider-side retention follows the policy of whichever upstream served the request.
Isolation between accounts
Every request is scoped to the workspace that owns the key. Balances, logs and usage are queried through that scope, so one account cannot observe or spend another.
Auditable administration
Administrative actions such as credit adjustments, provider changes and account status changes are written to an append-only audit log with the actor and the before and after values.
Disclosure
Reporting a vulnerability
If you have found a security issue, tell us before telling anyone else and we will work the fix with you.
Email security@openbase.ai with steps to reproduce and the impact you observed. We acknowledge reports within two business days and will keep you updated until the issue is resolved. Please do not run tests that degrade service for other customers or access data that is not yours.