Security
At rest: your provider API keys are encrypted at the application
layer with AES-256-GCM, and each ciphertext is bound to its tenant and provider so a
mis-scoped read fails rather than decrypts. Database backups are encrypted with
age before they leave the host and stored in Cloudflare R2 under
object lock. We make no claim about disk-level encryption.
In transit: TLS 1.2 and TLS 1.3 with ECDHE AES-GCM cipher suites only; older protocols are refused. HSTS is enabled site-wide with a one-year max-age, including subdomains.
Postgres Row-Level Security policies cover the 27 tables that hold tenant rows; the two token tables (password reset, email verification) are looked up by token hash instead. Work done for a tenant — dashboard, API, CLI, and the proxy — runs inside a transaction that switches to a non-bypass database role and sets a transaction-local tenant id, so the policies apply and reset at commit. Enforcement has been on in production since June 2026. Pre-authentication lookups (login, API-key resolution) and the operator API scope by the credential presented rather than by RLS.
Your OpenAI, Anthropic, Google, and DeepSeek keys are encrypted at rest with AES-256-GCM under a server-side key, with the ciphertext bound to your tenant and the provider. Keys are never logged, never returned by the API in any form (the provider-keys endpoint returns the provider, key version and rotation date only), and are decrypted in memory only while a proxy request is being forwarded.
Every ledger record is hash-chained (SHA-256) and signed with HMAC-SHA256 using a
server-side signing key. Sequence numbers are allocated under a Postgres advisory lock per tenant —
no gaps, no duplicates, even under concurrent writes. Verify any record range with
tolvyn ledger verify.
We capture metadata only: model, token counts, cost, latency, status, and your attribution tags. That's the minimum needed for financial governance, and it's the maximum we record.
A daily encrypted database backup, kept for 35 days, and a monthly backup written on
the 1st, kept for 400 days. Backups are encrypted with age
before upload and stored off-host in Cloudflare R2 with object lock, so the host cannot
delete its own history. Recovery is from these backups; we do not offer point-in-time
recovery.
TOLVYN holds no third-party certification today. We're happy to walk Enterprise customers through our controls in detail.
That's the full list. We notify customers by email at least 30 days before adding a sub-processor.
Found a security issue? Email [email protected]. We commit to acknowledging within 24 hours and providing a substantive response (fix timeline or non-issue explanation) within 5 business days. We do not currently run a paid bug bounty but we publicly credit reporters.
In scope: tolvyn.io, app.tolvyn.io, api.tolvyn.io, proxy.tolvyn.io, docs.tolvyn.io, and the TOLVYN CLI and SDKs.
Out of scope: vulnerabilities in our third-party providers themselves — Cloudflare, Razorpay, GitBook and Sentry — please report those to them directly. Our own configuration on those platforms is in scope, including the headers tolvyn.io serves and the content we publish on docs.tolvyn.io. Also out of scope: denial-of-service and volumetric testing; social engineering of our team or our customers; and physical attacks.
Please don't: access, modify or retain another tenant's data
— stop as soon as you can demonstrate access, and tell us what you saw;
run automated scanners against proxy.tolvyn.io, which forwards to
paid model providers and bills real money on every request; degrade service for
anyone else; or publish before we have responded within the window above.
With thanks to the researchers who have responsibly disclosed security issues to us: