Built to hold your keys and prompts carefully.
LinuxAir sits between your application and your model providers. Here is exactly what it stores, for how long, and how it's protected.
Your provider keys, encrypted
Provider API keys are stored in encrypted password fields and are never shown again after you save them. Requests go directly from LinuxAir to your provider on your account.
LinuxAir keys, hashed
API keys you create are shown once and stored only as SHA-256 hashes. Only a short prefix is kept for display. Revoking a key takes effect immediately.
Workspace isolation
Every provider, model, key and request belongs to a workspace, and ownership is checked on the server for every call. Platform-wide analytics are restricted to administrators.
Minimal prompt retention
Request logs keep a short preview (up to 400 characters) of the prompt and response for your dashboard. Previews are cleared automatically after 90 days.
Payments handled by processors
Payments go through Razorpay or Stripe. Card and bank details never reach LinuxAir; payments are verified by signature and credited exactly once.
Redaction before sending
Emails, phone numbers, card numbers, national IDs, IPs, secrets and your own patterns can be masked with placeholders before a prompt reaches a provider — and restored in the answer so your app still sees the real values.
Roles that are actually enforced
Invite people as Owner, Developer or Viewer. Every write endpoint checks the role on the server, so billing and policy stay with owners.
Abuse protection
Per-key rate limits, sanitised error messages that never echo URLs or secrets, and workspace suspension controls for operators.
Where your data goes.
| Data | Sent to | Stored by LinuxAir |
|---|---|---|
| Prompt and response | The model provider chosen for the request (on your key), redacted if you enable it | A preview of up to 400 characters each, cleared after 90 days |
| Prompt text for routing | The configured embedding model, if one is set (otherwise processed locally) | A cached embedding for up to 7 days |
| Answers to be checked | The judge model, only when an answer check runs | The judge score |
| Provider API keys | Only the matching provider | Encrypted |
| LinuxAir API keys | — | SHA-256 hash and a display prefix |
| Payment details | Razorpay or Stripe | Payment reference and amount only |
| Redacted values | Never — placeholders are sent instead | Only the count of masked values per request |
| Cached answers | — | In memory per workspace, expiring on a TTL |
Found a vulnerability? Email hello@linuxair.com with the details and we'll respond promptly.
Stop overpaying for easy prompts.
2,000 free credits on signup. Bring your own keys, change one base URL, and see the savings on your own traffic.