Security and data

How NagaAI handles your keys, your requests and your payments. The legal terms are in the Privacy Policy.

API keys: NagaAI stores only a SHA-256 hash of each key, so no one can read a key back, us included. The dashboard shows a new key once. You can give a key a spending limit or an expiry date, and disable or delete it at any time.
Your account: You can turn on two-factor authentication for sign-in. In an organization, only admins can change the privacy settings.
Request data: Every request leaves a record: time, key, model, status, token counts, latency and cost. We keep it for a year, for billing and for your Logs. Request and response bodies are stored only if you turn on data logging, and then for 30 days. Details are in Privacy and logging.
Training: Requests to paid models are not used for training unless you turn that on in the dashboard Privacy settings. Requests to free models may be used for training by NagaAI and its partners.
Where requests run: Our servers, which receive your requests, keep your account and bill your usage, are in the EU. The provider that runs the model may be elsewhere.
Model providers: Each request goes to a provider of the model you chose, which processes it under its own terms. If one provider fails, the request can move to another.
Payments: Payments go through Stripe, PayPal, Lemon Squeezy or a crypto processor, depending on the method you pick. You enter card details on the processor's page, so your card number never reaches NagaAI.
Uptime and incidents: Live availability and past incidents are on status.naga.ac. Each model page shows that model’s uptime.
Report a vulnerability: Write to [email protected]. The same contact is in security.txt.