Security and data

How we protect your account, your keys and your data.

Accounts and keys

• Passwords are stored as salted bcrypt hashes. We can't see your password.
• API keys are shown once, when you create them. We store only a SHA-256 hash, so a copy of our database would not reveal them.
• AI apps connect through OAuth and need you to click Allow. You can revoke any app or key in the console at any time.
• Credentials for services such as payments are stored encrypted with AES-256-GCM.

Spending control

• Before each run your AI quotes the price, and runs only after you agree. The charge never exceeds the quote.
• Each API key and each connected app can have its own daily and monthly spend limit. Once it is reached, no new runs start.
• You get an email when your balance drops below the amount you set.

Data

• We only collect publicly visible content, never private messages or data behind a login.
• Run results are kept for 30 days, then deleted. The run record and its charge stay.
• We don't sell customer data.
• You can export your account data from the console. When you close your account, your sign-in methods, email, and run inputs and results are deleted; billing records are kept as financial and legal rules require.

Payments

Card and Alipay payments are handled by licensed payment providers. Card numbers never pass through or are stored on our servers.

Transport

The whole site is served over HTTPS only, with HSTS.

Certifications

We don't currently hold third-party security certifications such as SOC 2 or ISO 27001.

Report a security issue

Found a vulnerability or a security problem? Email toph@prolevelmax.com and we'll get back to you quickly. See also security.txt.

Related: Privacy policy · Terms · Status