SECURITY

Security posture without inflated claims.

LatentKit sits between your application and AI providers, so credential handling, billing transparency, and operational access need clear rules.

BYOK secretsSupabase Vault
Console revealNot shown after save
Runtime accessServer-side only
CertificationsListed only when verified

CREDENTIALS

BYOK provider keys

Provider credentials are stored encrypted in Supabase Vault and are not logged or displayed back in the console after saving.

Runtime resolution

The gateway must resolve provider credentials server-side to fulfill authorized requests. LatentKit is not a zero-knowledge credential manager.

Operational access

Decrypted credential access is restricted to production runtime and privileged operational access. Customer admins rotate, disable, or delete keys rather than reveal saved secrets.

BILLING SECURITY

ModeWho owns provider billingLatentKit chargeWhere visible
BYOKYour provider accountPlan subscription only; 0% usage markupProvider invoice + LatentKit traces
Platform AccessLatentKit-managed provider accessProvider/model cost + 5% Platform Access feeLatentKit credit ledger
Free starter setupOne BYOK provider plus one Platform Access providerManaged usage follows the credit ledgerConsole usage and plan controls

Managed usage is priced with exact decimal arithmetic and rounded once at the ledger boundary, so per-dimension costs cannot drift with floating-point error. The gateway never automatically replays a request the provider may have already accepted — a timed-out generation is surfaced as an error instead of silently running (and billing) twice. Stripe billing webhooks are processed through a claimed, deduplicated inbox with automatic reconciliation alerts for stuck events.

OPERATIONAL SAFEGUARDS

How the platform itself is operated.

Least-privilege operations

Platform operations use separated roles: read-only viewers, operators limited to bounded diagnostics, and administrators. High-impact actions such as large credit adjustments require approval from a second administrator — the requester cannot approve their own change, and every approval is bound to the exact operation and expires if unused.

Certified providers

New providers start fail-closed. Before serving traffic, a provider must pass a live health test and be approved by a different administrator than the one who tested it. Managed routing is only available for certified providers, and administrative changes are written to an audit trail.

Fail-closed media ingestion

Remote image and audio URLs are fetched only over HTTPS from explicitly approved domains, with private-network and cloud-metadata addresses blocked, content types validated, and size, redirect, and time budgets enforced. Provider error text is scrubbed before it reaches logs or clients.

DATA HANDLING

Logs are useful. Secrets do not belong in logs.

LatentKit records operational metadata such as request IDs, route candidates, selected provider, fallback attempts, latency, cost, cache state, and guardrail state. Provider credentials are not written to request logs. Request traces and usage records follow workspace plan retention and operational settings.

Request IDTraceable
Provider keyNot logged
RetentionPlan-based
AI providersProcess routed requests

DISCLOSURE

Report a security issue

Send suspected vulnerabilities, credential exposure, account abuse, or billing-integrity issues to security@latentkit.com. Include enough detail to reproduce the issue. Do not access, modify, or destroy data that does not belong to you.