Hosted security

TEKIZ.AI Security

Effective June 19, 2026. This page explains the controls used for the hosted app, public API, customer keys, request history, and managed model access.

Public API

https://api.tekiz.ai accepts API requests only. Sign-in and dashboards live at https://app.tekiz.ai. Requests without valid access are rejected and receive setup guidance. They cannot reach a provider through the public API.

Authentication

  • /v1/* and /v1beta/* model routes require an active generated sk_tekiz_* customer API key.
  • We store a hash of each generated key, show the full key once, and let you revoke it from your account. Key status is checked again on the next request by default.
  • Account and billing pages require a valid Supabase user JWT and use the hosted account service.
  • /analytics, /analytics/funnel, setup, admin, discovery, and dashboard config routes require the private operator token.

Where provider credentials stay

By default, provider credentials, signed-in profiles, local models, Tailnet hosts, and private router tokens stay on customer-controlled machines or private infrastructure. A separate written managed-access agreement may define a different setup.

Rate limits and quotas

The public API limits the rate of requests made with generated keys. Requests can count against monthly account quotas stored in Supabase. If authentication or quota checks fail, requests are designed to be rejected. Billing and abuse controls remain in force during a failure.

Private request data

Launch reports do not expose prompts, messages, provider responses, plain-text API keys, provider credentials, sign-in tokens, or customer email addresses. Customer dashboards use /account/analytics and show only the signed-in account.

Managed model access

Managed model access is available only on plans that list it. To enable it, TEKIZ.AI needs provider permission, an approved provider list, pricing and margin checks, usage limits, key revocation, billing controls, private audit records, and abuse controls. Public status may show whether these checks pass. It does not show provider credentials, actual costs, prompts, or provider responses.

Checks before launch

Before launch, TEKIZ.AI checks API health, sign-in settings, rate and monthly limits, access controls, security headers, Stripe webhook signatures, and the public legal and security pages.

Reporting

Report security issues through GitHub private security advisories or contact support. Do not post secrets, provider keys, OAuth tokens, raw prompts, or customer data in public issues.