Is an AI API Relay Safe? Prompt Storage, Data Policies, and API Key Management
By LanoX Team. All facts checked on November 3, 2026 (Asia/Dubai). LanoX is the worked example; the 5 questions apply to any relay or aggregator.
An AI API relay is only as safe as the policies of all 3 parties your request passes through: your app, the relay, and the model provider. Before you send real data, get a written answer to 5 questions: does it store prompts and responses, does it use them for training, what records does it keep, where are the upstream policies, and how do you revoke a leaked key. Then manage your keys as if a leak will happen.
This article covers data and keys. Whether a relay serves the model it names is a separate question, covered in how to verify an LLM API relay serves the real model. Who runs LanoX and how it handles refunds is covered in Is LanoX legit?
Who handles your request on the way?
3 parties. The LanoX Security & Trust page describes the flow as: "We receive your request, send it to the model, and return the result to you." (checked 2026-11-03)
| Step | Party | What it does (LanoX wording) |
|---|---|---|
| 1 | Your app | "Submit prompts and receive model responses." |
| 2 | LanoX | "Processes and forwards the request without storing inputs or responses." |
| 3 | Model service | "Runs inference and returns the result to you." |
Each of the 3 can have its own data policy. A relay's promise covers only the relay.
What 5 questions should you ask any relay?
| # | Question | Why it matters |
|---|---|---|
| 1 | Does it store prompts and responses? | Stored content can leak later |
| 2 | Does it use your content for training? | Your data could shape a model others use |
| 3 | What records does it keep? | Usage and billing logs exist even when content is not stored |
| 4 | Where are the upstream providers' policies? | The relay's policy does not cover them |
| 5 | How do you revoke a leaked key? | A leaked key can spend your balance |
Ask for the answer in writing, on a public page or in a contract, not in a chat reply.
How does LanoX answer the 5 questions?
These are LanoX's own stated policies, quoted from its public pages on 2026-11-03. No third-party audit or certification is listed on those pages.
| # | LanoX's answer | Source |
|---|---|---|
| 1 | "Your prompts and responses are not stored." | Homepage |
| 2 | "LanoX processes your content only to complete your request, never for training, sale, or marketing." | Homepage |
| 3 | "Account, usage, and billing records support the service and do not include prompts or responses." | Security & Trust |
| 4 | "This page describes LanoX. Upstream providers have their own data policies." | Security & Trust |
| 5 | "revoke and replace any key that is exposed" | Security & Trust FAQ 03 |
For question 4, LanoX does not list each upstream provider's retention period, so check the provider of each model you use.
Also read the Privacy Policy (published July 20, 2026; effective July 30, 2026), not only the Security page. Its Section 2, item 3, "Content Generation Services," covers AI generation of "images, audio, video, and other content" and says that, after data is "strictly de-identified," LanoX "may use the collected data and the corresponding model-generated content for model optimization" (checked 2026-11-03). If that matters for your use, ask support which services it applies to before you send sensitive material.
How should you manage API keys?
Follow these 5 steps. They come from the Security & Trust FAQ 03 (checked 2026-11-03):
| # | Do this | LanoX wording |
|---|---|---|
| 1 | Keep keys server-side | "Store your API key on the server or in a protected local configuration." |
| 2 | Keep them out of public places | "Keep it out of browser code, public repositories, and screenshots." |
| 3 | Use 1 key per project | "For team use, manage keys by project" |
| 4 | Replace any leaked key | "revoke and replace any key that is exposed" |
| 5 | Clean your logs | "Redact keys from logs before sharing them for troubleshooting." |
The cost of a leak is direct: the Codex guide warns, "Do not leak your API Key, otherwise others may use your account balance." (checked 2026-11-03). In code and docs, use a placeholder such as $API_KEY, never a real key.
What about sensitive or regulated data?
Send less of it. Remove names, IDs, and secrets you do not need before the request leaves your app; no policy at any of the 3 parties can leak data you never sent.
If your company has stricter requirements, put them in a contract. The Enterprise page lists "Sub-accounts and quota allocation by member or department," and says teams can "Use separate API keys, projects, or member allocations with request-level usage records" (checked 2026-11-03).
Some platforms also offer regional routing. For example, the OpenRouter FAQ says requests to its EU endpoint are "routed only to shared provider endpoints in Europe" (checked 2026-11-03). If data location is a requirement, ask each candidate whether it offers this.
Who is LanoX not a good fit for, on data and security?
- Teams whose review requires a third-party audit report or certification. None is listed on LanoX's public pages as of 2026-11-03.
- Teams that need each upstream provider's retention period in one place. LanoX points you to upstream policies; you check each one.
- Teams that need EU-only data routing from a public page. LanoX's public pages checked on 2026-11-03 do not describe regional routing.
- Anyone who cannot accept item 3 of Part 2 of the Privacy Policy, on content generation services. Read it first, and ask support if unsure.
FAQ
- Does LanoX store my prompts?
- LanoX's Security page states it "Processes and forwards the request without storing inputs or responses." This is LanoX's own stated policy.
- Does a relay's privacy policy cover the model provider?
- No. LanoX's page says, "Upstream providers have their own data policies." Check each provider.
- What should I do if my API key leaks?
- Revoke it and create a new one, then check usage records for calls you did not make.
- Is the relay or the model the bigger risk?
- Either can be. Ask all 5 questions of every party that sees your data.
Sources
- Homepagechecked 2026-11-03
- Security & Trustchecked 2026-11-03
- Privacy Policychecked 2026-11-03
- Codex guidechecked 2026-11-03
- Enterprise pagechecked 2026-11-03
- OpenRouter FAQchecked 2026-11-03