How we handle your API keys
This page describes committed architecture. The bring-your-own-key feature itself is not live yet — this is how it's built to work once it ships.
GUIDE lets you connect your own accounts — an AI provider like Anthropic or OpenAI, or a science tool like Schrödinger or CDD — so features run against your subscription, not ours. Here's exactly what happens to a key once you give it to us.
Your key goes into Cloudflare's Secrets Store, encrypted at rest, tagged with which provider and which account it belongs to. We never store it in our own database, never log it, and never send it back to your browser once it's saved — not even to you. If you need to change it, you replace it; we can't show you the old one.
A key is only ever readable by the one system it's for. Your AI-provider key can only be reached by Orbie, the single component in GUIDE that's allowed to call any AI model — no other part of the product can touch it, by design, not just by policy. Your science-tool key can only be reached by the specific connector for that tool. Nothing else in GUIDE — not another feature, not another user's session, not an unrelated integration — has a path to your credential.
Nothing extra from us. We never mark up usage on a key you supply — you pay your provider directly, at their rates. GUIDE's own pricing is separate (seats, storage, and any GUIDE-hosted AI usage you choose instead of bringing your own key).
We can't see your key in plaintext after you save it. We can't use it for anything other than the feature you connected it for. We can't share it with another organization, even one you're also a member of, unless your workspace's own policy explicitly allows key sharing within that workspace.