Privacy

• The email address you sign in with.
• From checkout: the email address and the amount paid, as our payment processor reports them.
• API keys as a salted hash, with the key name, status, limits and timestamps. The key itself is shown once and not stored.
• One usage record per request: request id, model, token counts by class, the source of those counts, and the charge.
• The ledger of balance changes: top-ups, charges, refunds and disputes.
• SHA-256 fingerprints, never the text, of each request and response, so a signed receipt can show what was billed; and of large system prompts, kept 7 days, to find prompts many accounts send and cache them for everyone.
• Where your first visit came from: the referring site, the link’s campaign tags and the page you landed on, saved with your account when your first sign-in creates it.

Request and response bodies, unless you turn on replay for a key, which keeps that key’s request bodies for 7 days. Otherwise prompts and completions pass through the gateway and are not written anywhere. Scan output, source code and client data you send in a prompt are treated the same way.

• Cloudflare runs the service and stores the data above.
• Every model on the models page is served by third-party model hosting providers under contract with Uplink Switch LLC. They receive the request and response content for the calls they serve. Do not send data your engagement terms forbid you to share with a processor.
• OpenAI’s moderation API may classify a new message, and the system prompt when a safety check needs it. It receives that text. When it raises a flag we keep the categories, never the text.
• Our payment processor handles card payments for Uplink Switch LLC and holds your card details. PentestLLM never sees your card number. Where a crypto checkout is offered, it is run by Hidden (sellhidden.com), which receives the email address, the amount and the payment.
• Resend (resend.com) sends sign-in codes, receipts and account email. It receives your email address and the message.
• If analytics run on pentestllm.ai, they are Cloudflare Web Analytics, which counts page views without cookies, and Google Analytics, which receives the page address and title, the site that sent you, your browser and device, and an approximate location from your IP address. Neither runs in the console, and neither sees prompts, completions or keys. No advertising script runs on the site.

Keys are kept while the account is open. Usage records and ledger entries are kept as accounting records after it closes.

Signing in to the console sets a cookie that keeps you signed in, and one that remembers which organization you picked. A referral link sets one that holds its code for 30 days. Your first visit sets one for 90 days with the site that sent you, the campaign tags in the link and the page you landed on; when your first sign-in creates your account, they are kept with it. If Google Analytics runs, it sets its own cookies (named _ga) that tell a returning visitor from a new one, for up to two years.

Uplink Switch LLC answers valid legal process. What it can hand over is what the first section lists: account, key, usage and ledger records. It cannot hand over prompt or response text it does not keep.

The date at the top changes when this page does. Questions go to hello@pentestllm.ai.