apicuts
Done-for-you API gateway for all models. AI startups route their LLM calls through one endpoint, and we cut cost per request by at least 20%, without storing prompts or outputs.
[email protected]Compliance
Your data at a glance
- Prompts and outputs never stored
- Metadata-only logging
- No training on your data
- Encrypted in transit (TLS)
- NDA before kickoff
How your data flows
Passes straight through, never stored: prompts, completions, user content.
Logged for savings reports: timestamp, model, token counts, cost, latency.
- Gateway runs on Cloudflare's global network
- Encrypted connections only
- Unique accounts and multi-factor sign-in for production systems
- Prompts and outputs are never stored
- Metadata-only logging
- No training on your data
- Mutual NDA before kickoff
- Confidentiality agreements for everyone with access
- Security awareness training
- SOC 2 audit
- Incident response plan
- Business continuity and disaster recovery
- Minimum access
- Customer data deleted when you leave
- Data classification and retention policy
Resources
Controls
In place means we do it today. In progress means we are putting it in place as part of our SOC 2 work.
Infrastructure security
The gateway is served from Cloudflare's edge network, which brings DDoS protection and redundancy by default.
Requests to the gateway and to this website travel over HTTPS (TLS). Plain HTTP is not accepted.
Everyone with access to production uses their own account with multi-factor authentication.
Access to production systems, keys and logs is granted per person, only where the work requires it.
Accounts and keys are revoked as part of offboarding.
Product security
Requests pass through the gateway to your model providers. Prompt and completion content is not written to disk or logs.
We log only what savings reports need: timestamp, model, token counts, cost and latency.
Nothing you send is used to train models, ours or anyone else's.
Every optimization is tested against your quality and latency requirements and approved by you before it reaches production traffic.
Point your base URL back at your provider and traffic skips apicuts entirely. No migration needed.
Regular scanning of our code and infrastructure, plus an external penetration test.
Organizational security
We sign an NDA with every customer before any data is shared.
Team members and contractors sign confidentiality terms before they get access.
Security training at onboarding and every year after.
Internal security procedures
We are preparing for a SOC 2 audit. This page will show the report once it is complete.
A written plan for detecting, containing and telling customers about security incidents.
A documented plan to keep the gateway available, tested every year.
Changes to the gateway are reviewed and tested before they are deployed.
Every vendor that can touch customer data is listed on this page.
Data and privacy
We ask only for the access the work needs. A usage export is enough for a teardown.
Request metadata and anything shared for a teardown is deleted when the engagement ends, or sooner if you ask.
A written policy for how customer data is classified, kept and deleted.
Subprocessors
| Vendor | Purpose | Location |
|---|---|---|
| Cloudflare cloudflare.com | Gateway infrastructure and network | Global |
| Your model providers | Model inference for the requests you route through the gateway (OpenAI, Anthropic, Google and others you choose) | Depends on provider |
| Netlify netlify.com | Website hosting | Global |
| Cal.com cal.com | Call scheduling | United States |
| Google google.com | Video calls (Google Meet) and website fonts | United States |
| Slack, WhatsApp or Telegram | Support channel, only the one you choose | Depends on app |
Questions about security?
Email [email protected] for documents, a security questionnaire, or to report a vulnerability.