Security and privacy

​

What is stored for each call

Each call’s record (who, what started it, client, model, provider, tokens, cost, timings, status) is kept in your organization’s own database: a dedicated database on xpander cloud, or your install’s PostgreSQL when self-hosted. It is kept for Keep requests for in Policies: 90 days by default on xpander cloud, and until you set a limit when self-hosted. Prompt and response text is kept by default, encrypted with a key unique to your organization, and an admin can turn it off per group (Prompt and response text). Every change to that setting is in the Audit log. Keys, headers, images and files are never kept, and anything that looks like a secret is removed. Only roles that may view usage can open it, every opened request is logged, and it never appears in exports, log destinations or xpander’s own service logs.

​

Provider keys never leave

• Provider keys stay in your organization’s vault. The gateway adds a key to a call only on its way to the provider. No person, agent, desktop or app ever receives one, and a caller can’t redirect a call to collect it.
• An agent’s commands and skills never see a model credential. The harness holds only a placeholder for the run’s gateway token, and a relay on its executor puts the token on each model call (Agent runs).
• Keys never appear in logs, error messages or request records. A refused key is reported by name, never by value.
• On xpander cloud, model endpoints must be public, so a stored key never reaches xpander’s internal network (Model endpoints). Everywhere, an endpoint that resolves to a metadata or link-local address is refused on save and on every call.
• On a self-hosted install, a model key named by an environment variable never reads the install’s own credentials. Reserved names read as no key (Keys on a self-hosted install).
• Amazon Bedrock can use an IAM role instead of a key. On xpander cloud, your organization ID is the external ID, so no other organization can use the role (Bedrock IAM role).

​

Personal xpander keys

• Shown once at creation, then never again.
• Stored in your organization’s vault and matched by a fingerprint, never read back.
• Owned by a person, whose models, budgets and records apply. Refused from the next call once revoked or expired.
• Longest lifetime for a new API key in Policies caps new keys.
• Removed from each call before the provider, and never logged.
• The setup command passes the key to your coding tool for one launch only. Setup prompts never contain it.

​

Hybrid and Air-Gapped installs

On Hybrid, agents on your install call your install’s gateway: their prompts, answers and records stay in your environment, and only usage totals for billing reach xpander cloud. People’s coding tools connect through xpander cloud, which keeps their usage records and never their prompt or response text, whatever the group settings say. Your install’s records show in the Platform only when your browser connects directly to your environment. On Air-Gapped, everything stays in your install: the gateway, settings, keys, records and saved text. xpander’s keys are never used.

​

Next steps