Security
Private by default. Verified on every request.
evolved.to sits between your tools and the models you use, so we designed it on a least-exposure principle: we keep only what we need to run and support the service, for as short a time as possible.
Request lifecycle
What happens to every request
- 01
Encrypted in transit
Your client connects over HTTPS with modern TLS. Plain-text connections are refused.
- 02
Key verified
Your key is checked on every request. Unknown or revoked keys are rejected before anything else happens.
- 03
Plan and credit enforced
Each key carries its plan and credit limit, checked up front, so a request can never run up an unexpected bill.
- 04
Model resolved server-side
The model name you send is resolved to a route on our servers at request time. Your client never sees internal credentials.
- 05
Response normalized
The response is streamed back in the protocol you called, with internal and provider-specific details removed.
Logging & retention
What we keep, and what we never do
Our servers pass requests through without storing their content. Model providers may keep request data for a limited time for abuse monitoring, under their own policies.
What we log
- Request time, endpoint, status and a request ID
- Token counts per key, to enforce your credit limit
- Your orders and their payment status
- The email address you signed up with
What we never log
- API keys: we do not store them at all
- Authorization headers or credential-like fields
- Prompt and response content on our servers
- Your dashboard chats, which stay in your browser
API keys
Keys are treated like passwords
- Your key is sent to your email once your payment confirms. We do not keep a copy in our database.
- Your dashboard account never holds your key, so even a stolen password cannot reveal it or spend your credit.
- Each key is limited to its own plan and credit, and cannot reach other customers' data.
- Lost or leaked a key? Message support and we revoke it and send you a replacement.
Found a vulnerability?
Please report it privately and give us a reasonable time to fix it before disclosure. We respond to every report.