Market

Security and privacy

What ORBIX stores, what it doesn't, and how keys are protected.

What we store

  • Per request: key id, model, upstream, token counts, latency, list cost, discount and charge.
  • Per account: wallet address, API keys (hashed), balance and deposit history.

What we don't store

  • Prompt and completion bodies. They are streamed through to the upstream and back, and are not written to our logs or database.
  • Private keys or seed phrases. Sign-in is a signed message; ORBIX never asks for wallet secrets.

API keys

  • Keys are shown once in full when created, then stored as a hash.
  • Revoke a key at any time from API keys. Revocation takes effect immediately.
  • Each key has its own rate limit and daily subsidy cap, so a leaked key has a bounded cost.

Upstream providers

Requests are sent to the provider that serves the model. Their data policies apply to the content you send them. Choose models accordingly for sensitive data.

Official addresses only

The only contract addresses are the ones published on the $ORBIX page. ORBIX will never DM you, ask you to "verify" a wallet, or ask you to sign a transaction to claim anything.