Account access
Passwords are stored as salted scrypt hashes. Browser sessions use HttpOnly cookies, same-site restrictions and anti-CSRF checks. A recovery code is issued when an account is created.
PLATFORM SECURITY
Control the access. Understand the data.
Practical controls for accounts, API traffic, service credit and administrative actions.
API key controls
Full API keys are shown once. Only hashes are stored for authentication. Keys can be revoked independently and have individual monthly service-credit limits.
Service-credit controls
Charges are recorded in an append-only ledger. Inference reserves the maximum estimated charge before the upstream call, then reconciles actual token usage.
Request data
The RDGlobal usage ledger stores request metadata and token counts, not prompts or generated answers. Inference content is transmitted to the configured upstream service for processing.
Administrative separation
Customer registration does not create administrator access. Model changes, service grants and compute activation are restricted to administrators and recorded in the audit log.
Responsible disclosure
Use the contact form or an account support ticket to report a suspected vulnerability. Include steps to reproduce, the affected route and the impact, without sharing third-party personal data.