Security
Your keys and data, protected by default.
Parezen accepts a provider key only while the gateway has encryption in transit, encrypted key storage and rate limits all on. It stores metadata by default, not prompts. There is no SOC 2 or ISO claim.
Metadata by default
Cost analytics need only tokens, model, cost and latency, so that is all Parezen keeps by default. Inference includes that observability and OpenTelemetry (OTLP) export. Prompt and response capture is off by default; a workspace can turn it on with a retention period, sensitive values are redacted before storage, and turning it on is written to the audit log.
Provider keys
On the hosted gateway, Parezen holds your provider keys. With a self-hosted licence the gateway runs in your cloud and the keys never leave your network: you pin which provider hosts it may call, and no config update from Parezen can change that. Hosted keys are stored encrypted (envelope encryption), shown only by their last four characters, and never logged. Parezen accepts a key only while encryption in transit, encrypted storage and rate limiting are all on; if any one is off, keys are refused.
Sign-in and access
Single sign-on over OpenID Connect or SAML with verified email domains, SCIM provisioning, two-factor sign-in, roles and an audit log of every change.
Billing never blocks traffic on your own keys
If a payment fails you get 30 days of grace with alerts, then pass-through: requests are forwarded unchanged, while optimisation and paid features pause. Data export keeps working. Billing never returns an error on your production traffic. Your own keys are free to $10K a month at list price, with no card needed. On Parezen credits you are warned at 20% and 5% left, and auto top-up keeps you running.
If Parezen is slow or unreachable
Your app stays in control: when Parezen cannot be reached, does not start answering in time, or returns a 5xx, your code can send the same call straight to your provider with your own key. That path is not routed, recorded, budget-checked or billed. A 4xx, including a budget hard stop, must not take that path. See the fail-open guide.
Baseline count
A saving is the gap between your own baseline and your spend on the same work. Each month the ledger is checked against your provider bill, and only savings within 2% of that bill are verified and billed.
Security contact
Write to [email protected]. The same address covers privacy, legal, support and sales.