SECURITY

Your keys stay yours. Here's exactly how.

OneConductor is BYOK — bring your own keys — which means the vault is the single most important thing we build. Below is the plain-English version of how it works, and further down, the technical detail for anyone who wants to verify our claims rather than trust them.

Your keys are encrypted before they ever reach usWhen you paste an API key into the vault, it is encrypted on your device first. What reaches our servers is already ciphertext — we never see, log, or transmit a plaintext key.

Decryption is ephemeralA key is only decrypted in memory for the exact moment it is needed to call a provider on your behalf, then discarded. It is never written to disk in plaintext and never cached beyond that single call.

You can revoke instantlyRemoving a provider from your vault deletes its encrypted key immediately. Any mission or session already using it is cut off on its next call — there is no grace period where a revoked key still works.

Every use is on the recordEach provider call is written to your audit log with what it was for, which key was used, and what it cost. Nothing routes through your keys silently.

WHAT THIS DOESN'T CLAIM

We'd rather under-promise here.

Encryption at rest and ephemeral decrypt protect your keys from a data breach of our storage and from casual exposure in logs. They do not make OneConductor immune to every attack: a compromised device, a malicious browser extension, or a court order compelling disclosure are outside what any SaaS vault can promise to defeat. If you need keys that are provably never decryptable by any party but you, self-hosting is the honest answer — we're building toward that option, not claiming it today.

TECHNICAL APPENDIX

For the people who want the detail.

envelope encryption — each key is encrypted client-side with a per-user data key (AES-256-GCM); that data key is itself wrapped by a master key held in a managed KMS. We never hold an unwrapped data key at rest.

ephemeral decrypt — the gateway unwraps a key in-memory only inside the request scope of a provider call, uses it, and drops the reference. No plaintext key touches disk, a log line, or a cache layer.

revoke — deleting a vault entry removes its ciphertext and its wrapped data key; in-flight requests already holding a decrypted reference finish, but no new call can unwrap it afterward.

audit — every provider call is appended to a per-user, immutable ledger row: timestamp, provider, purpose (chat / orchestra / mission), and cost. The ledger is what powers the routing whisper and the cost proof on the pricing page — it is the same data you can see.

Questions we haven't answered here? Ask before you connect a key.

Start conducting — free See pricing