Your account

Security and privacy

How keys are stored, what Lamdy can and can't see, and how to remove your data.

Lamdy is built to need as little access as possible and to hold what it does need carefully.

Your keys

Read-only by design. Lamdy asks for keys that read billing and usage. It never sends requests to your providers on your behalf and never runs up charges.
Checked before saving. A key is verified with the provider first; a key that fails is never stored.
Encrypted at rest with AES-256-GCM. Only the last four characters are ever shown again, in Lamdy or anywhere else.
Removable any time. Delete a key on the Providers page and it is erased at once.
Scrubbed from errors. If a provider echoes part of a key in an error, Lamdy removes it before the message is saved or shown.

What Lamdy can see

Dates, models, token counts, costs, and the names of your projects and API keys, read from billing reports. Lamdy never sees your prompts, your model outputs or your end users' data.

With Stripe connected, Lamdy reads charges, customers, invoices and refunds through a restricted read-only key, to calculate revenue and margin.

Workspace isolation

Every row of data belongs to a workspace, and the database itself refuses to return a workspace's data to anyone who isn't an active member of it. A removed member loses access immediately. Notification webhook URLs are encrypted like provider keys.

Your account

Passwords are handled by our authentication provider and never stored by Lamdy.
Sign-in sessions renew quietly while you use Lamdy and end when you sign out.
Deleting your account (Settings) deletes your personal workspace and everything in it. Deleting a team workspace deletes all of its data.

Security and privacy

How keys are stored, what Lamdy can and can't see, and how to remove your data.

Lamdy is built to need as little access as possible and to hold what it does need carefully.

Your keys

Read-only by design. Lamdy asks for keys that read billing and usage. It never sends requests to your providers on your behalf and never runs up charges.
Checked before saving. A key is verified with the provider first; a key that fails is never stored.
Encrypted at rest with AES-256-GCM. Only the last four characters are ever shown again, in Lamdy or anywhere else.
Removable any time. Delete a key on the Providers page and it is erased at once.
Scrubbed from errors. If a provider echoes part of a key in an error, Lamdy removes it before the message is saved or shown.

What Lamdy can see

Dates, models, token counts, costs, and the names of your projects and API keys, read from billing reports. Lamdy never sees your prompts, your model outputs or your end users' data.

With Stripe connected, Lamdy reads charges, customers, invoices and refunds through a restricted read-only key, to calculate revenue and margin.

Workspace isolation

Your account

Passwords are handled by our authentication provider and never stored by Lamdy.
Sign-in sessions renew quietly while you use Lamdy and end when you sign out.
Deleting your account (Settings) deletes your personal workspace and everything in it. Deleting a team workspace deletes all of its data.