This page summarizes the security controls Pxie uses today. We describe only what is in place and we update this page as it changes.
Accounts and API keys
- Sign-in is handled by a dedicated authentication provider, and sessions are verified at our gateway.
- API keys are stored only as one-way hashes, never as plain text. A key is shown once when you create it.
- You can limit a key to specific IP addresses, hold up to 10 active keys, and revoke any key instantly.
- We keep the five most recent IP addresses used with each account, shown to the account holder, to help spot misuse of an account.
- Requests are rate limited per key (60, 300 or 1,200 requests per minute depending on plan), and request bodies are size limited.
Infrastructure and network
- All traffic to our website, API and MCP server uses HTTPS.
- Requests pass through a gateway that checks the key and credits before anything reaches our origin API. The origin refuses requests that do not come through the gateway.
- The API runs on Google Cloud Run in Montréal, Canada. Edge, database and storage run on Cloudflare.
- Secrets such as service credentials are held in managed secret stores, not in source code.
- The admin console sits behind Cloudflare Access with email one-time-code sign-in.
Application security
- The dashboard and admin pages use a strict content security policy.
- Alert webhooks are validated before use: Pxie refuses redirects, credentials in URLs and addresses that resolve to private networks.
- Payment events from Stripe are signature-checked and processed once only. Card details are handled by Stripe and never reach Pxie.
- Credits are reserved before a request runs and refunded once if it fails, to prevent double charging.
Data protection and resilience
- Customer data is kept only as long as needed (see Privacy Policy and Data Processing). Closing an account revokes access immediately and removes personal details.
- The account database is exported nightly to private storage for recovery. Backups are access-restricted and are deleted after 35 days.
- Uptime and data-source monitors alert us when a service or an upstream data feed stops working.
- Dependencies are checked for known vulnerabilities before release, and security fixes are applied through our release process.
Report a vulnerability
Email hello@pxie.ai with “Security” in the subject and enough detail to reproduce the issue. We aim to acknowledge reports within 5 business days. Please do not access other customers’ data, disrupt the Service or publish details before we have had a reasonable time to fix the issue. We will not take action against good-faith research that follows these rules.