What RedactCloud does not store

Raw or redacted prompt content.
Tool inputs, tool results, or response payloads.
Upstream OpenAI, Anthropic, Gemini, OpenRouter, or other provider credentials.

Account details and payload-free operational metadata are stored separately and never include the request body.

In-memory prompt handling

Prompts are redacted in ephemeral memory and forwarded immediately. Usage analytics store only request identifiers, provider/protocol/status fields, and counters — bytes processed, entities found, latency — never prompt text, tool payloads, or provider credentials.

Credential handling

API keys are shown once at creation, then stored only as Argon2id hashes with a separate SHA-256 lookup index.
Upstream provider keys pass through per-request headers; RedactCloud does not persist them.
Coding-agent connections use expiring, authenticated-encryption tokens held by the client. Each connection can be disconnected individually; revoking the linked RedactCloud API key invalidates all of its connections.
Connection-string passwords appearing inside prompts are themselves redaction targets.

Transport & infrastructure

TLS for all client and upstream connections.
Per-key rate limiting to contain abuse.
When contextual NER is enabled, analyzer outages fail closed by default and prompts are not forwarded upstream.

Compliance

RedactCloud provides technical controls that can support a privacy program. Your organization remains responsible for its own legal, contractual, and compliance validation. For security questionnaires, contact security@redactcloud.com.

Responsible disclosure

Found a vulnerability? Email security@redactcloud.com. Reports are reviewed confidentially and good-faith security research is welcomed.