Security guide
Last updated: October 23, 2026
How we store your OpenRouter key and what you can do to keep your account safe.
Quick summary
- Your OpenRouter API key is encrypted with AES-256-GCM before we store it
- We never show a saved key back to you, and it never appears in our logs
- Team custom scan headers (cookies and tokens) are encrypted with AES-256-GCM too. We send them only to the scanned page's own host, not to third-party resources the page loads. See Custom scan headers in the Privacy Policy for the exact rules.
- There are no AccessHawk passwords: you sign in with an email code or Google, GitHub or Microsoft
For legal details, see our Privacy Policy and Terms of Service.
Data protection
Paid plans can save an OpenRouter API key for BYOK (bring your own key). This section explains how we store and use that key. For everything else we collect, see the Privacy Policy.
Security measures
- AES-256-GCM encryption. We check your key with OpenRouter, then encrypt it with AES-256-GCM before saving it. The encryption key is derived for your account from a server secret and a random salt that's unique to you.
- Encrypted at rest. The key is never stored in plaintext. The server secret isn't kept in the database, so a copy of the database alone can't be used to decrypt it.
- Decrypted only when a scan uses it. Our scan worker decrypts the key on our servers when a scan runs on your key, and sends it only to OpenRouter.
- Kept out of logs. Our server logs are kept on our server for a limited time: removed once a size limit is reached or within a day after the service is updated or restarted, and never more than 90 days for the server's system log. Before a log line is written, our logger redacts fields such as keys, tokens and secrets and masks values that look like API keys. We never show a saved key back to you, in the app or in our admin tools.
When your own key is used
Scans within your plan's monthly allowance use our Anthropic key, not yours. Your saved key is used only when you pick a model from OpenAI, Google or xAI. Those scans don't count against your allowance, and once the allowance is used they're the only way to keep scanning until it resets.
Best practices
Here's how you can maximize your security when using BYOK:
Use a dedicated API key
Create a separate API key on OpenRouter just for AccessHawk. If it's ever compromised, you can revoke it without affecting other services.
Set spending limits
OpenRouter allows you to set spending limits on API keys. Configure a reasonable limit to prevent unexpected charges even if your key is compromised.
Monitor your usage
Regularly check your OpenRouter activity page to ensure there's no unexpected usage.
Protect your email and sign-in accounts
AccessHawk doesn't use passwords. You sign in with a one-time code sent to your email, or with Google, GitHub or Microsoft. Anyone who can read your email or use those accounts can sign in as you, so protect them with a strong password and two-factor authentication.
Only save a key if you need it
If you don't plan to use other models or go past your monthly scans, you don't need to save a key at all. You can remove a saved key in Account Settings at any time.
Rotate your key periodically
Every few months, create a new key on OpenRouter, save it in Account Settings and revoke the old one on OpenRouter. If an old key ever leaked, it stops working.
Frequently asked questions
Can you see my API key?
We don't display it anywhere, including our admin tools, and it isn't logged. Our servers do have to decrypt it to run scans that use it, as described above, which is why we recommend a dedicated key with a spending limit.
What is AES-256-GCM encryption?
AES-256-GCM is AES encryption with a 256-bit key in Galois/Counter Mode. GCM also authenticates the data, so a stored value that has been altered fails to decrypt instead of producing a wrong key.
What if there's a data breach?
A copy of our database alone isn't enough to decrypt your key, because the server secret is stored separately. A breach of our servers themselves could expose it, so set a spending limit on the key and revoke it on OpenRouter if you think it's been exposed.
What data do you store?
We store your account details, projects, scan results and screenshots, and your encrypted API key if you save one. For site analytics we use Umami, which we run ourselves, and Cloudflare Web Analytics. Neither uses cookies. For full details, see our Privacy Policy.
How do I remove my API key?
Go to Account Settings and click "Remove" next to your API key. This deletes the encrypted key from our database. You can also delete your whole account from Account Settings.