Security and Privacy When Using AI APIs: What You Need to Know

Integrating AI into your application means sending data to third parties. Here's how to do it securely.

The Risks

1. Data Sent to Providers

Every prompt you send is processed by external servers. This includes:

• User data
• Proprietary information
• Source code

2. Data Retention

Some providers may:

• Store request logs
• Use your data to train models
• Retain information indefinitely

3. Information Leaks

A poorly designed prompt can expose:

• API keys
• Personal information (PII)
• Business secrets

Main Provider Policies

Provider	Trains with API data?	Retention
OpenAI (API)	No by default	30 days
Anthropic	No	30 days
Google	Configurable	Variable

Important: These policies are different for free products vs enterprise APIs.

Best Practices

1. Never Send Sensitive Data in Prompts

Bad:

Analyze this email from user john@email.com 
with card 4532-xxxx-xxxx-1234

Good:

Analyze this email from user [USER_ID_123]

2. Implement Data Masking

function maskPII(text) {
  return text
    .replace(/\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Z|a-z]{2,}\b/g, '[EMAIL]')
    .replace(/\b\d{4}[- ]?\d{4}[- ]?\d{4}[- ]?\d{4}\b/g, '[CARD]')
    .replace(/\b\d{3}-\d{2}-\d{4}\b/g, '[SSN]')
}

3. Use Enterprise Agreements

For sensitive data, consider:

• BAA (Business Associate Agreement) for healthcare
• DPA (Data Processing Agreement) for GDPR
• SOC 2 compliance

4. Encrypt API Keys

Never hardcode API keys:

// ❌ Bad
const apiKey = "sk-abc123..."

// ✅ Good
const apiKey = process.env.OPENAI_API_KEY

5. Implement Rate Limiting

Protect against abuse and unexpected costs:

const rateLimit = require('express-rate-limit')

app.use('/api/ai', rateLimit({
  windowMs: 60 * 1000,
  max: 10 // 10 requests per minute
}))

How PromptRouter Handles Security

1. We don't store content: Only metadata for routing
2. Encryption in transit: TLS 1.3 for all communications
3. Encrypted API keys: AES-256 for your credentials
4. Minimal logs: Only what's necessary for billing

Security Checklist

• API keys in environment variables
• Data masking implemented
• Rate limiting active
• Logs don't contain PII
• Privacy agreements reviewed
• Periodic audits

Conclusion

Security isn't optional when working with AI. Take the time to implement the right protections from the start.

---

PromptRouter is designed with security in mind. Learn more about our security or get started free.