Security

Jell sits between your agents and the data providers they call. That means we hold API keys, balances and run history on your behalf. Here is how that is handled.

Keys and access

• API keys are stored hashed; the full secret is shown once at creation and cannot be retrieved afterwards, only rotated.
• Keys are scoped per client. Revoking a key takes effect immediately, and dashboard access is scoped to the key that signed in.
• Provider credentials Jell contracts on its own side are never exposed in API responses, logs or error messages.
• Minting keys and changing auto top-up need a signed-in dashboard session: an API key cannot create more keys or charge the saved card, so a leaked key cannot outlive its own revocation.

Your data

• Run inputs and outputs are stored so you and your agents can retrieve run history; they are never used for another customer or sold.
• Billing state (balance, holds, settlements) is append-only ledger data, so every charge is traceable to a run you can inspect.
• On request, we delete your stored run history and close the account; accounting records are kept only as long as the law requires.

Reporting a concern

Security disclosures: [email protected]. We acknowledge reports within two business days.