Multisis runs on the provider keys you bring, so it is fair to ask what happens to them once you paste them in. This page explains how we protect them, what we do not do, and what you can do on your side.
Encrypted at rest with AES-256
Your keys are never stored as plain text. Before a key is saved to our database, it is encrypted with AES-256, the same standard used by banks and governments to protect sensitive data.
This means that even if someone gained access to the raw database, they would see scrambled data instead of usable keys.
The encryption key lives somewhere else
Encryption only helps if the key that unlocks it is kept apart from the data it protects. The encryption key is stored separately from the database, in server-side secrets, so reading the database alone is not enough to decrypt anything.
Protected in transit
Every connection between your browser, Multisis and your AI providers uses HTTPS. Your keys are encrypted while they travel, not only while they are stored.
Used only when you ask a question
A key is decrypted only at the moment it is needed to send your request to the provider you chose for that role. It is held in memory for that request and is not written to logs.
Never shown back in full
Once a key is saved, Multisis does not display it again. You will only see a masked version, such as the last few characters, so shoulder-surfing, screenshots and screen shares cannot expose it.
Kept away from other users
Your keys are tied to your account. Other users cannot see them, use them or draw on their quota, and your usage never counts against anyone else's limits.
Not sold, shared or used for anything else
We use your keys for one purpose: sending your prompts to the providers you selected. They are not shared with third parties, and we do not use them to run our own traffic.
You stay in control
- Remove a key at any time from your settings, and it is deleted from our database.
- Revoke it at the source by deleting the key in your provider's dashboard. It stops working everywhere immediately.
- Watch your usage in your provider's dashboard, where every request made with your key appears.
How to stay safer on your side
No system can promise perfect security, so a few habits add a second layer of protection:
- Use a dedicated key for Multisis instead of one you share across other projects. If it ever needs to be revoked, nothing else breaks.
- Set spending limits or quotas in your provider's dashboard where it is supported.
- Stick to free tiers if you can. A free key has a hard ceiling, so the worst case is limited.
- Rotate keys now and then, and right away if you ever suspect a leak.
- Never paste keys into screenshots, support chats or public repositories.
What we cannot promise
We follow established practices, but no service can honestly claim to be unhackable. What we can promise is that we take layered precautions, we will tell you quickly if something affects your data, and you will always be able to cut off access yourself by revoking the key with your provider.
Questions?
If you have a security concern or want to report a vulnerability, contact us and we will respond as soon as we can. You can also read the privacy policy for how keys and chats are handled.