Trust
Security
A short overview of how ElseLane handles trust and data. Full legal detail lives in the Privacy Policy.
Transport security
Production traffic is served over HTTPS/TLS with HSTS. Responses include baseline browser protections (nosniff, referrer policy, frame denial). Secrets and API keys are never logged in plaintext in application responses.
What we store
Account identity (email, auth credentials/hashes or OAuth links), credit balance, API key hashes, and usage metadata (status, model, provider, credits, latency, attempts summary). Prompt and answer bodies are not retained after the request completes.
What providers receive
To generate an answer, the prompt (and optional system message) is sent to the AI providers tried for that request. Those providers process data under their own terms.
PII guardrails
High-risk patterns such as SSNs, payment card numbers (plausible IIN + Luhn), private keys, and common cloud secrets are blocked by default before any provider call. Names, emails, phones, and normal amounts are not scanned. Admins may configure global redact mode.
Payments
Card data is handled by Stripe. ElseLane stores Stripe customer/session references and credit ledger events — not raw card numbers.
Your controls
Revoke API keys, export usage as CSV, unlink OAuth providers, and permanently delete your account from the dashboard.
Security concerns and responsible disclosure: security@elselane.com. Please include steps to reproduce and avoid accessing other customers' data. We aim to acknowledge reports within 3 business days. General privacy questions: privacy@elselane.com or the contact form.