> ## Documentation Index
> Fetch the complete documentation index at: https://docs.rockapi.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# AI API security and privacy checklist for production teams

> Review AI API security, prompt privacy, API key management, data retention, billing metadata, and compliance questions before production use.

# AI API security and privacy checklist for production teams

AI API security starts with the same basics as any production API: protect credentials, scope access, log only what you need, and review vendor data handling before sending user traffic.

## Key questions before production

| Topic           | Security question                                                                  |
| --------------- | ---------------------------------------------------------------------------------- |
| Prompt handling | Are prompts or completions stored, logged, or used for training?                   |
| Metadata        | What billing metadata is retained, such as token counts, model name, or timestamp? |
| API keys        | Can you rotate keys and separate development from production?                      |
| Access review   | Who can create, view, or revoke keys?                                              |
| Error logs      | Do logs contain secrets, prompts, or personal data?                                |
| Vendor review   | Can your team document the data path and retention policy?                         |

## Rock API data handling summary

Rock API does not store or log prompts and completions. Requests are forwarded to upstream providers in real time, and responses are streamed back to the caller. Rock API retains billing metadata needed to calculate usage, such as token counts, model used, and timestamp.

For the full policy, read [Security and privacy](/security-and-privacy).

## API key management best practices

* Store API keys in a secret manager or environment variables.
* Never commit keys to Git.
* Rotate keys after employee offboarding or suspected exposure.
* Use separate keys for local development, staging, and production.
* Remove unused keys and review access regularly.
* Monitor usage spikes that may indicate accidental exposure.

## FAQ

### Does an AI API store prompts?

It depends on the provider and gateway. Always read the security and privacy documentation. Rock API does not store or log prompts or completions, but it does retain usage metadata for billing.

### What is AI API billing metadata?

Billing metadata is the non-content information needed to calculate charges and operate the account, such as token counts, model name, request time, and usage totals.

### Is a single API key less secure?

A single key reduces the number of provider keys your team manages, but it still needs strong handling. Treat it as a production secret, rotate it when needed, and limit who can access it.

## Next step

For general API key practices, read [Secure API key management](/blog/buyers/secure-api-key-management).