Security

Security is foundational to an API that sits in your production path. This page summarizes how kryyt handles requests and data. It is a template — review and adapt with your security team before launch.

Data in transit

All API traffic is encrypted with TLS. Requests must be sent over HTTPS to https://api.kryyt.com/v1.

API keys

• Keys are bearer credentials — treat them like passwords.
• Rotate and revoke keys from the dashboard at any time.
• Scope keys per environment to limit blast radius.

Data handling & retention

API traffic is encrypted with TLS. Your chats, uploaded files, and generated responses and files are retained on our servers for account and chat continuity, as described in our Privacy Policy; you can delete content or your account at any time. Application and login run on app.kryyt.com; API endpoints on api.kryyt.com.

Model providers

To generate responses, prompts are routed to the provider of the model you select (currently DeepSeek, with GLM, Kimi, Qwen, and MiniMax coming soon). Each provider processes data under its own terms. Payment data is handled by Paddle, our Merchant of Record.

Reporting a vulnerability

Email security@kryyt.com with details. We welcome responsible disclosure and aim to acknowledge reports promptly.