TokenAPI Scan

Security Policy

TokenAPI Scan takes user data security and privacy protection seriously. This page explains our API key handling mechanisms, data storage policies, and security measures in detail.

Not StoredAPI keys are never written to databases, logs, or public reports.
Use & DestroyAfter the detection request completes, the key is released from memory.
Detection OnlyKeys are used solely for verifying the target endpoint you specify.

🔐 API Key Security

Are API keys stored?

Absolutely not.

TokenAPI Scan only holds your API key briefly in memory during the detection request. It is destroyed immediately after the check completes. The entire process:

  • ✅ Never written to any database
  • ✅ Never written to any log file
  • ✅ Never forwarded to any third party
  • ✅ Full key never appears in detection reports

Your API key only ever travels between your browser and the detection process memory, and disappears as soon as the check is complete.

How is my API key used during detection?

When you initiate a detection, your API key is used only for:

  • Sending a verification request to the target model API endpoint
  • Comparing protocol response fields to identify relay providers

Your key is not used for any other purpose. We will never use your key to make requests unrelated to detection.

What is saved in detection reports?

Public detection reports only contain the following information:

  • ✅ Detection time and results
  • ✅ Protocol field analysis data
  • ✅ Model response characteristics
  • ✅ First 8 characters mask of the API key (only for you to identify your own report)

The full API key never appears in any public or private report.

🛡️ Data Security

What security audits have been passed?

TokenAPI Scan's core detection engine has passed international security standard audits, and critical code paths have been reviewed by professional security teams:

  • ✅ No hidden data exfiltration logic
  • ✅ No silent key harvesting mechanisms
  • ✅ No background data upload channels

Our security commitment is built on transparent, verifiable technical implementation, not mere verbal assurances.

Is self-hosted deployment supported?

Yes.

For enterprise users and those highly concerned about data security, TokenAPI Scan offers self-hosted deployment options:

  • ✅ Full functionality deployed to your own servers
  • ✅ API keys never leave your network boundary
  • ✅ Custom security policy support

For self-hosted deployment, please contact us for detailed plans.

📞 Contact Us

What if I find a security vulnerability?

If you discover any security vulnerabilities or suspicious behavior, please contact us immediately through the following channels:

  • 📧 Email: [email protected]
  • ⏱️ We commit to responding and investigating within 24 hours
  • 🏆 We offer reasonable security bounties for valid vulnerability reports

Your feedback is an important driving force for us to continuously improve our security standards.