Privacy & Security Last updated: October 2026

API Key Security & Encryption Architecture

Detailed overview of AES-256-GCM authenticated encryption and zero-knowledge client boundaries.

How Your Keys Are Protected

- In Transit: All credential exchanges occur exclusively over TLS 1.3 / HTTPS.

At Rest: Credentials are encrypted with AES-256-GCM using unique 96-bit initialization vectors (IVs) and 128-bit authentication tags.

- No Client Exposure: Plaintext keys are never returned in JSON API responses. Only masked representations (e.g. AIza••••••••487) are visible.

Isolated Ownership: Database queries enforce user_id foreign key isolation, preventing cross-tenant access.

Ready to manage your API connections?

Add, test, or replace encrypted provider credentials in the Settings Center.

Go to API Connections

Related Guides & Documentation

API Integrations

Connecting YouTube Data API v3

Privacy & Security

Privacy and Data Controls