SECURITY
Security is foundational, not an afterthought.
We've designed Allotly so your sensitive data stays where it belongs — with you and your providers.
Architecture Overview
Teams: Zero Data Path
When organizations connect their own API keys, calls go directly from the client to the provider. Allotly never sees, stores, or processes prompt content for Teams users — only token counts and cost metadata flow through our systems for budget enforcement.
- Direct Connection
- No Proxy
Vouchers: Process-Only Proxy
Voucher-based calls are proxied through Allotly solely for metering. Prompts and completions flow through but are never stored — only metadata (token counts, costs, timestamps) is written to the database.
- Metering Only
- No Storage
Encryption
- API Keys: AES-256-GCM encryption at rest
- Passwords: scrypt hashing with salting
- In Transit: HTTPS/TLS for all connections
- Database: Encrypted at rest (PostgreSQL)
Data Practices
What We Store
- Account information (name, email)
- Organization and team metadata
- Usage metrics (token counts, costs, timestamps)
- Encrypted AI provider API keys (for Teams)
What We Don't Store
- Prompts or input content
- Completions or output content
- Conversation history
- Files or attachments sent to AI models
Compliance
- GDPR: GDPR-compliant architecture and data handling
- Audit Logging: Comprehensive audit trail for all administrative actions
Infrastructure
- PostgreSQL: Primary data store, encrypted at rest
- Redis: Rate limiting, caching, session management
- Audit Logging: Full trail of administrative actions
Responsible Disclosure
Found a vulnerability?
We take security seriously. If you discover a security issue, please report it responsibly to security@allotly.ai. Do not disclose it publicly until we've had a chance to address it.