Security & Compliance

We build the Service around four principles: least privilege, encryption everywhere, minimal data retention, and financial-grade integrity. We are a developer-facing API gateway, so we deliberately collect and store only the minimum data needed to operate and bill for the Service.

• Encryption in transit: all traffic between your client, our gateway and our systems is encrypted using TLS.
• API keys: we store only a cryptographic hash of your API key and display only a prefix and the last few characters; the full key is shown once at creation.
• Upstream secrets: third-party Provider credentials are stored encrypted or as references, never as plaintext in our databases.
• No sensitive logging: we do not log Authorization headers or, by default, the body of your prompts and model responses.
• Payments: card data is handled by PCI-DSS-compliant payment providers (for example Stripe); we do not store full card numbers.

• Edge protection: our public endpoints sit behind Cloudflare, providing DNS, WAF, DDoS mitigation and TLS termination.
• Network isolation: the internal relay that forwards requests to upstream Providers runs on a private network and is not exposed to the public internet.
• Data stores: production databases and caches are not exposed to the public internet.
• Access control: administrative access to production requires strong authentication, including MFA.

• Authentication: account access requires verified email and secure session handling.
• Rate limiting & quotas: per-key rate limiting and monthly quota enforcement protect the platform from abuse.
• Role-based access: the admin console enforces role-based and field-level permissions (for example, sensitive cost data is visible only to authorized roles).
• Audit trail: high-risk administrative actions require a recorded reason and write to an audit log.

• Integer arithmetic: all monetary amounts are computed in integer micro-USD to avoid floating-point errors.
• Immutable ledger: account balances are derived from an append-only ledger; every credit or debit creates a ledger entry.
• Idempotency: payment and billing operations use idempotency keys so that retries and duplicate events cannot double-charge or double-credit.

We process personal data in accordance with our Privacy Policy, including rights under the GDPR and CCPA where they apply. Where you require a Data Processing Agreement (DPA) or additional documentation, please contact us.

The practices described on this page are provided for transparency. We may update them at any time, in our sole discretion, without notice. Nothing on this page constitutes a warranty, representation or contractual commitment, and we provide no compensation and bear no liability except as set out in our Terms of Service.

We monitor the Service for availability and security incidents and respond according to an internal incident-response process. Where required by law or where it materially affects you, we will notify affected users.

To report a security vulnerability, please contact us at support@admesh.ai. We ask that you not publicly disclose a vulnerability before we have had a reasonable opportunity to address it.