Security overview

Data minimisation

• The tryaii SDK routes on your own computer. It never sends prompt or response text to TryAii; the client refuses to upload a record that carries such a field and the server rejects one too.
• File paths are uploaded relative to your project, never as absolute paths on your computer. The prompt hash is keyed with a secret that never leaves your computer.
• Statistics across customers come only from an anonymous table (no user, application, process, file, function or prompt-hash field; at least 3 applications per row).

Encryption

• All traffic to tryaii.com and api.tryaii.com uses TLS.
• The monitor database (Amazon RDS for PostgreSQL, Stockholm) is encrypted at rest with a customer-managed AWS KMS key with automatic rotation, in a private network that only our API server can reach.
• The website database (MongoDB Atlas) is encrypted at rest.
• Database backups are encrypted with AWS KMS.

Keys and sign-in

• Application keys and API keys are stored only as hashes; the full key is shown once.
• Provider API keys you save on tryaii.com are stored encrypted with AES-256 and are never written to logs.
• Command-line sign-in uses the OAuth device flow; refresh tokens rotate on every use, and a reused token ends the session.
• The API server loads its secrets from AWS Secrets Manager. No secret is kept in source code.

Access and logging

• Access to production systems is limited to the people who run the Services.
• We do not write prompts, model answers or monitor records to application logs; log lines carry identifiers and counts.

Retention and deletion

Monitor call records are deleted after 90 days; a deleted application is purged 30 days after deletion. The full schedule is in the Privacy Policy.

Incidents and reports

If a security incident affects your personal data, we notify you without undue delay and within 72 hours of becoming aware of it, as our DPA requires. To report a vulnerability, write to [email protected]; please do not test against other customers' data.

Compliance

We are working towards SOC 2. We do not hold a certification yet and will say so here when we do.