> ## Documentation Index > Fetch the complete documentation index at: https://docs.capriole.ai/llms.txt > Use this file to discover all available pages before exploring further. # LLM Gateway Security Risks: What to Ask Before Sending Code > Logging, retention, training, keys and data location: what to check before you send source code through an LLM gateway, and how Capriole AI answers each. A third-party LLM gateway adds one more company that sees your prompts and code, may keep them in logs, holds the API keys your tools use, and forwards each request to model providers you may not have chosen. Before you send source code through one, ask what it stores and for how long, whether it trains on your content, which companies and countries receive the request, how keys are revoked, and what happens when a provider fails. Capriole AI is one such gateway. It costs USD 8 a month for unlimited web chat with GPT-6 Astra, Claude Fable 5.1, Claude Opus 5.5, and Gemini 4 Argon, and its API costs up to 92% less than official API prices for your apps and coding agents. Below, each question comes with Capriole AI's answer from its own documentation, including what it does not offer. ## The risks, what to ask, and Capriole AI's answers | Risk | What to ask | Capriole AI's answer | | - | - | - | | Content logging | Is request and response content stored? For how long, and who can read it? | The API keeps no request or response content, only a usage record for each request, such as the time, model, and token counts. [What the API keeps](https://docs.capriole.ai/guides/privacy-and-security.md#what-the-api-keeps) | | Training | Does the gateway train on your content? Do the providers it routes to? | Capriole AI does not use your chats, files, or API content to train AI models. Each provider handles requests under its own terms. [Training](https://docs.capriole.ai/guides/privacy-and-security.md#your-content-is-not-used-for-training) | | Upstream exposure | Which companies receive each request, and under whose terms? | The model provider that answers it, or a cloud platform that hosts its models. Infrastructure providers carry requests on the way. [Who receives your data](https://docs.capriole.ai/guides/privacy-and-security.md#who-receives-your-data) | | Data location | Where are the servers and database? Where do the providers process data? | The main servers and database are in India; providers process data in other countries, including the United States. Connections are encrypted. [Security](https://docs.capriole.ai/guides/privacy-and-security.md#security) | | Key misuse | Can you disable and delete keys, and see usage per key? | Yes. You can name each key, the full secret is shown only once, and you can deactivate or delete a key and filter usage by key. [Manage keys](https://docs.capriole.ai/guides/api-keys-usage.md#deactivate-reactivate-or-delete-a-key) | | Runaway spending | Is spending capped? | API usage draws on a prepaid token balance, and agents stop when it runs out. On a Team, owners and admins can cap each member. [Alert and cap tokens](https://docs.capriole.ai/guides/team-plan.md#set-alert-and-cap-tokens) | | Team access | Who on a team can see whose usage? | Team owners and admins see each member's email, role, and Team API usage. [Who receives your data](https://docs.capriole.ai/guides/privacy-and-security.md#who-receives-your-data) | | Silent fallback | When does the gateway fall back, and does it keep your chosen model? | Only before a response begins, and the model you asked for is kept. [Fallback](https://docs.capriole.ai/articles/unified-model-api.md#fallback-happens-before-the-response-begins) | A gateway does not protect you from prompt injection or from what a coding agent does on your machine. The agent still reads your files and runs commands locally, so its own permission settings matter as much as the gateway's. Web chat history is separate from the API: you choose whether it is kept on your account, only in your browser, or not at all. The [privacy and data controls guide](https://docs.capriole.ai/guides/privacy-and-security.md) and the [privacy policy](https://docs.capriole.ai/legal/privacy.md) are the full text. ## What Capriole AI does not offer Capriole AI is built for individuals and small teams. It has no SAML single sign-on, publishes no compliance certifications such as SOC 2 or ISO 27001, and offers no dedicated support SLA. If your company requires any of these before code leaves your network, Capriole AI does not meet that requirement. ## Before you send source code through any gateway 1. **Strip secrets first.** Keep `.env` files, credentials, and private keys out of the files and context you send. 2. **Give each tool its own key and test it.** Send a first request from a project with nothing sensitive in it, check that the usage row shows the key and model you expected, and deactivate keys you no longer use. The [API keys and usage guide](https://docs.capriole.ai/guides/api-keys-usage.md) shows each step. 3. **Check the provider's terms too.** The gateway's policy covers the gateway. The model provider that answers handles the request under its own terms. The [one API key for coding agents](https://docs.capriole.ai/guides/one-api-key-coding-agents.md) guide sets up 10 agents, and the [Claude Code](https://docs.capriole.ai/integrations/claude-code.md) and [Codex](https://docs.capriole.ai/integrations/codex.md) pages cover each client's configuration. ## Frequently asked questions > [accordion] Is it safe to send source code through an LLM gateway? > > It depends on the gateway's answers to the questions above: what it stores, whether it trains on your content, who receives each request, and how keys are controlled. Capriole AI keeps no API request or response content and does not train on it, but every request still reaches the model provider that answers it. > [accordion] What should I do if an API key leaks? > > Delete the key on the API page and create a replacement. Deactivating stops new requests at once if you want to investigate first. See [deactivate, reactivate, or delete a key](https://docs.capriole.ai/guides/api-keys-usage.md#deactivate-reactivate-or-delete-a-key). ## Get started > [card] [Read the privacy guide](https://docs.capriole.ai/guides/privacy-and-security.md) > > What Capriole AI keeps, where, and for how long. > [card] [Get an API key](https://www.capriole.ai/?view=api) > > Premium: unlimited web chat and an API key for USD 8 a month. Capriole AI facts on this page are maintained as first-party documentation. This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.