Security
Built so one mistake does not expose another.
Plain answers to what we store, what we never keep, and how the service limits the damage when something goes wrong.
Practices
How we protect your account
Keys are shown once
An API key secret appears only when you create it. We store a hash, never the secret.
Strict browser policy
Pages load only our own scripts, styles, fonts, and images, and cannot be framed by other sites. The one exception is the public pages that show the website chat, only while it is switched on: they also load the chat widget from our own chat server (chat.pilot.e3d.ai, a subdomain we run). The account, billing and sign-in pages never do.
Prepaid and bounded
Spending is limited to credits you bought, so a leaked key cannot run up a bill.
Separate credentials
Signing in to the dashboard and calling the API use different credentials that cannot be swapped.
Your data
What we keep, and what we never do.
Stored only as hashes
- API key secrets: a keyed hash, never the secret itself.
- Passwords: slow, salted hashes, held by the account service.
- Dashboard sessions: random 256-bit identifiers, stored hashed, in cookies scripts cannot read.
Never logged or stored
- Key secrets, passwords and one-time sign-in codes are never written to logs.
- Card numbers and receipt links: payments run on Stripe, and we keep only the payment id, pack, amount, currency and status.
- Question text in usage records: they hold counts, credits, outcome and model names.
Questions and debates
Where your questions go.
Shared only with your debate panel
Debate questions and answers go only to the AI companies on your account's debate panel, so they can respond. Unless you choose fewer in Settings > Debate panel, the panel is every company offered (at most four: Anthropic, OpenAI, Google and xAI), so a question goes to all of them. Anthropic always takes part and writes the final summary. Write self-contained questions and leave out secrets, credentials and personal data.
Web search, only when it is on
When web search is turned on for the service, the models on your panel may send your question text to their company's own search tool (Anthropic, OpenAI, Google or xAI) to look up current facts, and read the pages it finds. Web pages can be wrong or try to mislead a model; the sources are listed with each answer, unverified. You can turn web search off for your account: untick “Use web search” in Settings, Debate defaults. The first time you ask with it on, a short notice repeats this. From a connected client, pass web_search: false for a single debate.
Kept for a set period
Saved debates are deleted automatically after a retention period; each result shows the date it is kept until. You can delete any debate, or all of them, at any time.
Gone when you leave
Deleting your account revokes keys, ends sessions and deletes the account record and its debates. Financial records stay under a pseudonymous id for accounting and disputes.
In the browser
Locked down by default.
Pages load scripts, styles, fonts and images only from pilot.e3d.ai (the one exception: while the website chat is switched on, the public pages that show it also load the chat widget from our own chat server at chat.pilot.e3d.ai, and the account, billing and sign-in pages never do), cannot be framed by other sites and send no referrer. Every change made from the dashboard needs a matching origin and a CSRF token, and the service grants no cross-origin permissions, so other websites cannot call it from a browser.
Disclosure
Report a vulnerability
Email us with the details and steps to reproduce. We acknowledge reports promptly and will not pursue good-faith research.
Send a report to security@pilot.e3d.ai.