Encrypted the moment you save
Your key is scrambled before it lands in our database. We use Amazon Web Services (AWS) KMS—the key vault many enterprises trust—to protect each organization's encryption keys.
How we keep your API keys safe
When you connect your OpenAI, Anthropic, or other provider keys to LineMod, we treat them like the secrets they are—encrypted, access-controlled, and never shown again after you save.
The short version
You bring your own provider keys so LineMod can route traffic on your account. We lock them down with strong encryption and Amazon's key management service, and only use them when your apps make authorized requests.
Only the right people in your org
Adding, changing, or removing keys requires an admin on your team. If you use two-factor login, we'll ask you to confirm again for sensitive actions.
You can see what happened
When keys are added, updated, or removed, it appears in your activity log—without exposing the key itself.
Protected by AWS KMS
Amazon Key Management Service (AWS KMS) is how we guard the master keys that encrypt your provider secrets. It's run by AWS, independently audited, and separate from everyday staff access.
- Your organization's encryption keys are held in AWS KMS—not as a password someone at LineMod could look up.
- KMS is used when routing real traffic to your provider, not for employees to browse customer keys. AWS maintains its own audit trail of key usage.
- Each organization's keys are isolated. Only our production routing systems can request decryption—and only for live requests you send.
Our team cannot read your keys
No LineMod employee—not support, not engineering—can open a screen and view your saved provider key. There is no "show full key" button and no internal back door.
- After you save, we only show a short hint (like sk-...abcd), never the full key.
- Even with access to database backups, an attacker would see encrypted data—not your usable API key.
- We don't offer bulk export or download of stored provider keys.
- Your key is briefly decrypted in memory only while routing an authorized request to the provider.
What happens when you add a key
From paste to first routed call—in plain language.
- You paste your provider key — Sent securely over HTTPS. We check that it works with the provider, then encrypt it right away.
- We store only the encrypted version — The scrambled key lives in our database. We keep a short hint so you know which key it is.
- Your app calls LineMod — When a request needs your key, we decrypt it in memory, call the provider on your behalf, and discard the plaintext.
- You can remove a key anytime — We delete the encrypted copy from our systems. We also recommend rotating the key at the provider.
Controls you have
- Only organization admins (or higher) can add, update, or delete provider keys.
- If your account uses two-factor authentication, sensitive key actions ask for a verification code.
- BYOK routing won't silently spend platform credits unless you explicitly turn that option on.
Our commitments
- We will never show your full provider key after you save it.
- We don't stash plain keys in fast caches or shared memory pools.
- API responses never include your key—only the short hint.
Need more detail for a security review?
Enterprise customers can request deeper architecture documentation. Contact us and we'll share materials for your security team's evaluation.