What is stored for each call
Prompt and response text is kept by default, so you can review what your agents and people sent and got back. An admin can turn it off per group, and every change is recorded in the Audit log (Prompt and response text). When text is saved:
- keys, headers, images and files are never kept, and anything that looks like a secret is removed;
- only people whose role may view usage can open it, and every opened request is recorded in the Audit log;
- it never appears in exports, in log destinations, or in xpander’s own service logs.
Provider keys never leave
- Provider keys are stored in your organization’s vault. The gateway reads a key only when a call needs it and adds it to the call on its way to the provider.
- No person, agent, laptop or app ever receives a provider key, and a caller cannot point a call at another endpoint to collect one.
- Provider keys never appear in logs, in error messages, or in a request’s record. A key the provider refuses is reported by name, never by value.
- On xpander cloud, a model endpoint must be a public address, so a stored key is never sent to an address inside xpander’s network (Model endpoints).
- Amazon Bedrock can use an IAM role instead of a stored key; on xpander cloud the role is assumed with your organization ID as the external ID, so no other organization can use it (Bedrock IAM role).
Personal xpander keys
- A key is shown once, when it is created, and can’t be shown again. Its value is kept in your organization’s vault, and calls are matched to it by a fingerprint, never by reading the value back.
- Every key has an owner, and its calls run with that person’s models, budgets and records. A revoked or expired key is refused from the next call.
- Longest lifetime for a new API key in Policies caps how long new keys may live.
- The key is removed from each call before it reaches the provider and is never written to a log.
- The setup command in AI models & keys passes the key to your coding tool for one launch only, and the setup prompts it offers never contain the key.
Hybrid installs
- Agents on your install call your install’s gateway. Their prompts, answers and request records stay inside your environment; only usage totals for billing reach xpander cloud.
- Your people’s coding tools connect through xpander cloud. Their usage records are kept in your organization’s xpander cloud database, and their prompt and response text is never kept there, whatever the group settings say.
- Request records of your install are shown in the Platform only when your browser connects directly to your environment.