Esta página está em inglês.
Security
Transport, key storage, retention, and how to report a vulnerability.
Transport
The public site and API are served over TLS (Let’s Encrypt on the OVH app host). Call https://strike-ai.eu.
API keys
Keys are stored as a hash (SHA-256 with a server pepper) and encrypted at rest. The console shows a prefix, not the full secret, after creation. Create a new key and revoke the old one when you rotate. See Authentication.
Hosting
Web, API, and strike-1 inference run in the EU on OVHcloud Gravelines (GRA11), France. PostgreSQL is on Google Cloud SQL in europe-west1 (Belgium) until the database moves. Details: EU hosting and data.
Customer data
Strike does not train on customer prompts or outputs. Request bodies are not stored unless you send options.retain: true. Trace spans sent to POST /v1/traces are stored for 30 days. Prompt text is included in a trace only when the SDK capture_content flag is on.
Retention
| Data | How long |
|---|---|
Retained requests (options.retain) | 7 days on Free, 30 days on Pay as you go, 90 days on Enterprise. Delete earlier with DELETE /v1/retention/{request_id}. |
| Security and request logs | 30 days |
| Audit log | 3 years |
Reporting a vulnerability
Email contact@strike-ai.eu with a description and a way to reproduce the issue. Do not include live customer data. We acknowledge best-effort during beta. There is no bug-bounty programme yet.