Security

An API key is shown once, at the moment it is created. We store only its SHA-256 hash and a short prefix so you can recognise it in your dashboard. A lost key cannot be recovered by us or by anyone who reads our database; you revoke it and create a new one. Keys can be disabled instantly from the dashboard, and each key can carry its own spend cap, model allowlist and rate limit.

All traffic to rapidrouter.ai runs over TLS. The API process itself listens only on the local loopback interface behind nginx; it is not reachable from the network directly, so the reverse proxy terminates TLS and is the only way in.

Every key is limited to 60 requests per minute by default, adjustable per key. Responses carry X-RateLimit-Limit, X-RateLimit-Remaining and X-RateLimit-Reset headers so your client can back off cleanly. On top of that there is a per-user ceiling on concurrent in-flight requests, which also stops a nearly empty balance being spent many times over in parallel. Sign-in endpoints are throttled per IP.

Dashboard sessions use signed JWTs. Every account carries a token version, and "sign out everywhere" bumps it, which invalidates every previously issued session token at once, including on other devices. Passwords are stored as bcrypt hashes. Google and GitHub sign-in never give us a password at all.

Administrative actions are gated server-side by role on every request, not hidden in the UI. A customer account cannot reach admin routes, and administrator status cannot be claimed at signup.

If you store your own provider keys with us, they are encrypted at rest with AES-256-GCM under a key derived from a server-side secret using scrypt. Each stored key gets its own random nonce and an authentication tag, so ciphertexts cannot be tampered with or swapped between rows, and a database dump alone cannot decrypt them. The dashboard only ever shows back the last four characters. Every key is test-called against its provider before it is accepted.

On an ordinary request, prompts and model responses are not written to our database. Request logs hold metadata: model, token counts, latency, status and cost, a short classified provider error line when a request failed, and the user field, HTTP-Referer and X-Title values if you sent them. Four features you choose to use do store bodies, each scoped to your own account and deleted on a schedule: the response cache, enabled per request, until its expiry (at most 24 hours; the semantic variant also stores an embedding of the conversation, computed by the embedding provider, OpenAI by default); Capture, enabled per key, for 1, 7 or 30 days; the Batch API, which keeps each request body and result for 30 days so results can be fetched; and Idempotency-Key retries, which keep the full response for 24 hours so a retry returns the same answer.

Payments are processed by our payment gateway; card details never touch our servers. Every top-up gets a numbered invoice naming your company.

Rapid Router does not currently hold a SOC 2 report or an ISO 27001 certification, and we will not describe the service with those labels until it does. What is on this page is the honest state of the implementation.

If you find a vulnerability, email support@rapidrouter.ai with enough detail to reproduce it. We will acknowledge within two working days, keep you informed while we fix it, and credit you if you want credit. Please do not access other customers' data, degrade the service, or publish the issue before we have had a reasonable chance to fix it. We do not run a paid bounty programme today.