1. Encryption and Secure Storage
- All traffic to the site, console, and API is served over HTTPS (TLS).
- Passwords are stored as bcrypt hashes, never in their original form.
- Customer API keys are stored as SHA-256 hashes.
- Integration credentials, such as upstream provider keys and SSO secrets, are encrypted at the application level using AES-256-GCM, with keys stored separately from the database.
2. Account Authentication
- Verify your email using a one-time password (OTP) that is valid for a limited time.
- The option to log in via SSO (e.g., Google, GitHub, Discord), if enabled.
- Session cookies marked with
HttpOnly,Secure, andSameSite=Laxare valid for a maximum of 7 days. - Rate limits for login attempts, sign-ups, and OTPs, as well as Cloudflare Turnstile on public forms.
- Suspended accounts cannot log in or use the API.
3. Handling API Keys
- The key is displayed in its entirety only once when it is generated and cannot be viewed again.
- Keys can be restricted in terms of scope, validity period, and credit limits, and can be revoked at any time from the console.
- Credentials in the request body are replaced with
[redacted]before being stored. - The upstream provider’s identity and credentials are never sent to the customer.
4. Isolation and Access Control
- Data requests, logs, balances, and API keys are separated by account; users can only access their own data.
- Admin functions are restricted to the admin role, and any changes to sensitive settings—including enabling body logging and adjusting balances—are recorded in the audit log.
- Request and response content is not stored by default; if body logging is enabled, the content is automatically deleted according to the retention period. See the Privacy Policy.
5. Service Protection
- Public traffic passes through Cloudflare to mitigate bots and volumetric attacks.
- Rate limits per API key and per IP address, as described in the Usage Policy.
- Reserving funds before a request is processed prevents excessive use beyond the available balance.
- Model and upstream health monitoring is published on the Status page.
6. Audit log
We log security events such as logins, logouts, registrations, the creation and revocation of API keys, and changes to settings, along with the time, IP address, and user agent. Secret values are never logged.7. Shared Responsibility
8. Incident Response
When a security incident occurs, we identify, contain, remediate, and evaluate it. If the incident results in a breach of personal data protection, we notify the affected users and the relevant authorities in accordance with the provisions of the Personal Data Protection Act. If we detect a leaked API key, we can deactivate it and notify its owner.9. Reporting Vulnerabilities
Please submit a report to halo@hostlinku.com with a description, steps to reproduce the issue, and the impact you observed. We will confirm receipt within 5 business days. To ensure testing remains safe:- Test only with your own account and data;
- Do not access, modify, or delete other users’ data;
- Do not engage in denial-of-service attacks, spam, or social engineering against staff or users;
- Please give us a reasonable amount of time to make corrections before publishing the findings.