Security
Security
The main promise: your API keys go from your browser straight to the provider, and never through RouteVault.
BYOK (bring your own key)
When you check a key on the Local Lab or BYOK pages, the request goes from your browser directly to openrouter.ai. The key is not sent to RouteVault, not logged, and not stored anywhere on our side.
Accounts
Passwords are stored hashed and never in plain text. Sessions use HttpOnly cookies, so scripts on the page can't read them. Magic-link tokens are single-use and expire.
Data sources
All data on the site comes from public sources: provider list prices and Artificial Analysis benchmark indexes. Nothing is scraped from private accounts.
Found something?
If you find a security issue, email [email protected] and we'll fix it. Thanks for the heads-up.