Security

How Fluxix handles your keys and the data that passes through it, including exactly what is stored.

Not stored

• Provider API keys sent in x-provider-key are used to forward the request, not written to the database, and removed from service logs.
• Full Fluxix API keys: only a SHA-256 hash and a short prefix are kept. Keys are shown once.

Stored in your project

• Audit log entries: agent, session, decision, matched rule, the user's message (up to 8,000 characters), tool name and arguments, and the model's reply.
• The original values behind masked data, in the audit entry.
• Approval requests, including the tool call and conversation.
• Policies and rules.

Report a vulnerability: security@fluxix.ai