API security and privacy
Your API keys can spend your organization’s money, so protect them like passwords. On the data side, Syntic’s published terms say API content is not used to train general Syntic models by default.
Protect your keys
- Keep private keys (
sk_live_…) on servers only, never in browser or mobile code. For browser use, a public key restricted to your website’s origins is the right tool. See Private and public keys and Restrict a key to allowed origins. - Store keys in environment variables or a secrets manager, not in code or chat messages.
- Rotate keys from time to time, and revoke any key that may have leaked. See Rotate an API key and Revoke an API key.
More advice: Keep your API keys safe.
Protect the account
- Turn on two-step verification. The Console asks for it at sign-in, and creating keys needs a verified session when it is on. See Two-step verification in the Console.
- Owners can require two-step verification for every member in Settings → Admin Settings.
- If an account may be compromised, use Sign out everywhere and revoke its API keys.
Your data
- Training: the Privacy Policy and API Terms on syntic.ai say inputs and outputs sent through the Syntic API are not used to train general Syntic models by default.
- Zero data retention: some models can’t be used by organizations running with zero data retention. See Zero data retention.
- Disabled accounts: keys created by a disabled account stop working with
403 account_disabled.
Report a problem
Found a vulnerability? Follow Report a security problem.
Learn more
Was this page helpful?