Security

Keys and secrets

Your ElevenRouter API keys

Shown once at creation and stored only as SHA-256 hashes; a leaked database cannot yield working keys. Keys can carry spend limits, rate limits, allowed models and an expiry, and can be rotated or revoked instantly.

Your vendor keys (BYOK)

Encrypted with AES-256-GCM under a key held outside the database (with versioned rotation); decrypted only in memory to sign the upstream call, never shown again, removable at any time.

Our upstream credentials

Encrypted the same way, never exposed in responses, errors, logs or receipts — customers see the model vendor, not the route.

Management keys and sessions

Rate-limited; every administrative action they perform is audit-logged with actor, IP and request id. Sign-in supports two-factor authentication.

Data in transit and at rest

• All traffic to and from ElevenRouter, and from ElevenRouter to vendors, uses TLS.
• Prompts and completions are not stored unless your organization enables it; when enabled they are stored encrypted with a 30-day retention you can shorten or purge.
• Request metadata (tokens, cost, timing, routing) is stored for billing and your logs; guardrail events record detector names and counts, never matched text.
• Card data never touches our systems; payments are handled by our payment processor.
• Retention follows the periods in the Privacy Policy; deleting a key drops its cached responses immediately and deleting an organization removes its keys, policies, presets and stored bodies.

Access and auditing

Production access is limited to the platform operators and used for running the service, support and abuse prevention. Inside an organization, members see the workspaces they belong to; owners and admins see everything and every change to keys, budgets, members, policies and settings is recorded in an audit log kept for 24 months and visible to you.

Abuse and spend protection

• Per-key rate limits and organization, workspace and key budgets with hard or soft enforcement and alerts by e-mail, webhook or Slack.
• Guardrail policies: model and vendor allow-lists, prompt-injection detection, and redaction of e-mails, phone numbers, cards, secrets and custom patterns before a prompt leaves ElevenRouter.
• Circuit breakers, health tracking and identity checks on every route, so a misbehaving upstream is taken out of rotation automatically.
• Zero-completion insurance and exact per-request billing, so a failure upstream never becomes your cost.

Your part

• Keep keys out of source control and client-side code; use one key per environment or customer, with limits and an expiry.
• Prefer the management API for provisioning so keys are created with the right scopes.
• Turn on two-factor authentication for every member with owner or admin rights.
• Review Logs and the audit trail; set low-balance and budget alerts.

Reporting a vulnerability

If you find a security issue, please tell us privately at hello@elevenrouter.com before disclosing it. Include steps to reproduce and any affected ids. We acknowledge reports within two business days, keep you informed while we fix the issue, and credit you if you wish. Please do not access other customers' data, degrade the service, or use automated scanners against production; a staging endpoint can be arranged for deeper testing. Details of what we store are in the Privacy Policy.