Security Pillars
Six foundational layers protecting every API call, every time.
End-to-End Encryption
All transit uses TLS 1.3. At rest, AES-256 across every storage layer — no exceptions.
Zero Data Retention
Prompts and responses are never persisted. Every request is ephemeral — held in memory, then gone.
Access Control
Granular API key scoping, IP allowlisting, and per-key rate limits. Only authorized traffic passes.
Network Isolation
Each tenant runs in a separate VPC. Cross-tenant data leakage is architecturally impossible.
Continuous Monitoring
24/7 automated threat detection with anomaly alerting and a sub-5-minute incident response SLA.
Secure Development
Every commit goes through peer review, SAST, DAST, and dependency scanning before reaching production.
What Happens to Your Data
Every API request follows this exact path. Nothing persists. Nothing leaks.
Request
- TLS 1.3 handshake at edge
- API key validated & hash-checked
- IP allowlist + rate limit enforced
Processing
- Routed to isolated tenant env
- Payload held in memory only
- Model inference — never touches disk
Response
- Response re-encrypted in transit
- Metadata-only audit log written
- Ephemeral context immediately destroyed
Regulatory Standards
Responsible Disclosure
Found a vulnerability? Report it to security@aichixia.xyz. We respond within 48h and never pursue action against good-faith researchers.
Infrastructure
CIS-hardened enterprise cloud with multi-region failover, audited regularly by independent third parties.
Developer Security Guide
Five things every developer integrating Aichixia should do from day one.
Common Questions
Answers to the most frequently asked security questions.
Never. We have a strict zero data retention policy. The only data logged is anonymous metadata — timestamp, model ID, token count — for billing and rate limiting. Actual content is never written to any persistent storage.
Keys are hashed with bcrypt before storage. The plaintext key is shown exactly once at creation. You can set expiry dates, scope keys to specific models, and restrict them by IP allowlist from your dashboard.
No. Requests are forwarded to upstream providers under strict Data Processing Agreements that explicitly prohibit using customer data for training. We only partner with providers offering zero-training guarantees.
We maintain a documented incident response playbook with sub-5-minute automated alerting. Affected users are notified within 72 hours of a confirmed breach, in full compliance with GDPR Article 33.
Enterprise customers can request our latest third-party pentest summary under NDA. Email contact@aichixia.xyz with the subject 'Security Report Request' and we'll respond within one business day.