Security

This page describes the protections TOKEN runs today. The source code of the service is public (zeroais/thetoken), so each point can be checked.

Your request data

• We do not store prompts or responses. Request and response content passes through TOKEN to the provider serving the model and back to you. The database keeps usage records only (time, model, token counts, cost, key name, provider, latency, status). Details and retention periods are in the privacy policy.
• Only the provider that serves a request receives its content. Each model’s providers and their data locations are listed on the providers page. The us-eu-hosted group keeps requests on US and EU hosts (how).
• We do not use your content to train models, and we do not sell personal data.

API keys

• A key is shown once, when you create it. TOKEN stores only a hash, so nobody at TOKEN can read your key.
• Rotate key in the console replaces a key at once; the old key stops working immediately. Deleting your account revokes all its keys.
• Each key can have a spending limit. A request reserves its worst-case cost before it runs and its maximum output is lowered to what the balance and the key’s limit can pay, so neither can be overspent by concurrent requests.
• We are alerted when a key is used from many networks within an hour (a sign of a leaked key) and investigate.

Accounts

• Passwords are stored with bcrypt. Two-factor authentication and passkeys are available to every account and mandatory for TOKEN staff.
• Sign-up and sign-in are protected by Cloudflare Turnstile and by rate limits per network; sign-up requires a verified email address.
• Abuse limits per account: at most 60 API requests a minute and 10 in flight at once (errors and limits).

Payments

Card payments are made on Moyasar’s hosted payment page. TOKEN never sees or stores card numbers. Payment notifications are accepted only with a shared secret, and every payment is confirmed with Moyasar before credit is added, once per payment.

Infrastructure

• HTTPS only: plain HTTP redirects to HTTPS, and the console sends HSTS, a strict Content Security Policy and anti-framing headers.
• Hosted on Google Cloud (us-east4): two or more API instances across zones, a high-availability database with point-in-time recovery, data encrypted at rest by Google Cloud. Provider credentials and other secrets live in Google Secret Manager, never in code.
• Abusive traffic is rate-limited and banned at Google’s load balancer (Cloud Armor).
• The status page is hosted outside our infrastructure, so it stays up when we are down.

Reporting a vulnerability

Email support@thetoken.dev with “Security” in the subject. Include the steps to reproduce and the impact you expect. We acknowledge reports within 2 business days and keep you informed until the issue is fixed. Please do not access other people’s data, degrade the service, or make the issue public before it is fixed. We do not run a paid bug bounty. Machine-readable contact: /.well-known/security.txt.