Hosted security
TEKIZ.AI Security
Effective June 19, 2026. This page explains how the hosted app, public API, customer keys, request history, and managed model access are protected.
Public API
https://api.tekiz.ai accepts API requests only.
Sign-in and dashboards live at
https://app.tekiz.ai. Requests without valid
access are rejected and receive setup guidance; they never receive
provider access.
Authentication
-
/v1/*and/v1beta/*model routes require an active generatedsk_tekiz_*customer API key. - Generated keys are hashed at rest, shown once, revocable from the account page, and rechecked on the next request by default.
- Account and billing pages require a valid Supabase user JWT and use the hosted account service.
-
/analytics,/analytics/funnel, setup, admin, discovery, and dashboard config routes require the private operator token.
Where provider credentials stay
By default, provider credentials, signed-in profiles, local models, Tailnet hosts, and private router tokens stay on customer-controlled machines or private infrastructure. A separate written managed-access agreement may define a different setup.
Rate Limits and Quotas
Generated-key traffic is rate-limited at the public edge and can be counted against durable monthly Supabase quotas. Quota or auth infrastructure failures are designed to fail closed. Billing and abuse controls remain enforced during a failure.
Private request data
Launch reports do not expose prompts, messages, provider responses,
plain-text API keys, provider credentials, sign-in tokens, or
customer email addresses. Customer dashboards use
/account/analytics and show only the signed-in account.
Managed model access
Managed model access is enabled only on plans that list it. Before launch, TEKIZ.AI must have provider permission, approved providers, pricing and margin checks, usage limits, key revocation, billing controls, private audit records, and abuse controls. Public status may show whether these checks pass, but never provider credentials, actual costs, prompts, or provider responses.
Checks before launch
Before launch, TEKIZ.AI checks API health, sign-in settings, rate and monthly limits, access controls, security headers, Stripe webhook signatures, and the public legal and security pages.
Reporting
Report security issues through GitHub private security advisories or the support path published by the project. Do not post secrets, provider keys, OAuth tokens, raw prompts, or customer data in public issues.