Security and data handling

Keys and passwords

API key secrets are shown once. We store a keyed hash, never the secret, and never write keys to logs.
Passwords are handled by the account service and stored only as slow salted hashes. We never log passwords or one-time codes.
Dashboard sessions are random 256-bit identifiers stored only as hashes, in cookies that scripts cannot read.
Keys and dashboard sessions are separate credentials and cannot be used in place of each other. A key spends only up to its cap and never more than the account balance.

What we store

Account: your email address and verification state.
Keys: a name, a short display prefix, a hash, a spending cap, timestamps and status.
Billing: one credit balance per account and a ledger of holds, charges, purchases and refunds, keyed by an internal user id. Payments run on Stripe; we keep the payment id, pack, amount, currency and status, never card numbers or receipt links.
Usage: for each request the tool, number of calls, estimated tokens, credits charged, outcome, duration and model names, tied to a pseudonymous reference for the website or the key.

What happens to your questions

Debate questions and answers are passed only to the AI companies on your account's debate panel, so they can respond; the first of them also writes the final summary. The recommended panel is Anthropic and OpenAI. A tool call from a connected client may name fewer of your panel's companies, never one outside it. Write self-contained questions and do not include secrets, credentials or personal data. Usage records hold counts and model names, not question text.

Where Decisions is turned on for your account, you can save a finished debate as a decision. A decision keeps its own copy of the question, the answer, how much the models agreed, the dissent, the model names and the debate date, plus the title, status and optional outcome and private note you add. It never holds the transcript or the individual model positions. Only you can see your decisions; they are never sent to an AI company and never used in other debates.

Kept for 365 days after your last change to its title, status or outcome, then deleted automatically. Deleting a debate does not delete a decision made from it; delete decisions under Decisions, one at a time or all at once. Closing your account deletes them all.
A share link lets one other person read a decision without an account. It shows the status, the outcome (not your note), the question, the answer, the agreement and dissent, the model names, the debate date and when the link expires, and "Decided by" and "Why" if you filled them in; never your title, note, email or anything else about your account. The "Share" button on a finished debate saves it as a decision if it is not one yet and makes a 7-day link in one step. Decided by (up to 80 characters, one line) and Why (up to 1,000 characters) are text you write; they are shown as plain text and we do not check them. Do not put in anything you would not want a stranger holding the link to read. Links last 1 to 30 days (7 by default) and you can turn one off at any time; it also stops working when the decision is deleted or the account is closed.
Anyone who has the link can read the page until it expires or you turn it off. Apps that preview links may keep a copy even after that. We store only a hash of the link, never the link itself, and the page is marked so search engines do not index it.
Each shared page has a link id and a "Report this page" contact; we aim to take down abusive pages within 24 hours.

Web search

Web search is off until it is turned on for the service (it is being rolled out one company at a time). When it is on:

The models on your panel may send your question text to their own company's search tool (Anthropic, OpenAI, Google or xAI) to look up current facts. Those companies write the search queries themselves; we never see or keep the queries or the pages they read.
You can turn it off for your account: untick "Use web search" in Settings, Debate defaults, which the Ask page then follows (the first time you ask with it on, a short notice repeats this and asks you to confirm; it is shown until you ask with it, then not again). From a connected client, pass web_search: false to e3d_debate for a single debate. Web search can go to a model company's search tool and the search provider behind it; web pages can be wrong or try to mislead the models.
The sources each model found are listed with the answer as plain text (the domain, the title and the address, never a link or an image). They are not verified. A web page can be wrong or contain text meant to mislead a model: each model has no tool other than search, other models never see page text, and we never open a source address ourselves, but a page can still influence the answer of the model that read it. Treat the answer accordingly.
We store, per debate, the number of searches per company, the domains of the sources and whether a model ran over its search limit or a source contained instructions. We never store excerpts, search queries or page text.
Search is charged per search inside the estimate the Ask page shows before you start. Turning search off removes its search cost from the estimate.

Browser protections

Pages load only scripts, styles, fonts and images from pilot.e3d.ai, cannot be framed by other sites, and send no referrer. Every change request from the dashboard needs a matching origin and a CSRF token. The service sends no cross-origin (CORS) permissions, so other websites cannot call it from a browser.

Deleting your data

Delete your account in Settings. Keys are revoked, sessions end, unspent credits are forfeited after confirmation, and the account record is deleted. Financial records are kept under the pseudonymous user id for accounting and dispute handling. The same email can register again and receives a new id. See Credits and billing.

Report a vulnerability

Email security@pilot.e3d.ai with what you found and how to reproduce it. Please do not access other people's data. Good-faith research is welcome; see also /.well-known/security.txt.

Questions

For anything else, write to support@pilot.e3d.ai.