What we hold, and what we do not

This service can hold credentials to other people's systems, which is a real obligation rather than a checkbox. This page says exactly what that means in practice.

Stored credentials

A key you store is sealed with AES-256-GCM before it reaches the database, is opened only to make a call you asked for, is never written to a log, and is destroyed when you delete the connection. We do not use it for anything you did not request, and we cannot read it out of a backup in plaintext.

What a call record keeps

Every call is recorded with the account, the provider, the operation, the time and the outcome, because that record is what a charge, a refusal and an abuse report all rest on. Request and response bodies are not kept.

What you are responsible for

A provider's own terms still apply to calls made with your key or ours, and using an integration to do something that provider forbids is between you and them. We will disable an integration that is being used to break someone else's terms.

Questions

What happens to a key I store here?

It is sealed with AES-256-GCM before it reaches the database and is only ever opened to make the call you asked for. It is scoped to your account, it is never logged, and deleting the connection deletes it. For an OAuth provider we hold a refresh token instead, and revoking the link at the provider stops the calls here immediately.

Can I use this without a Leumas account?

Browsing, reading every schema and comparing providers need no account at all. Making a call needs one, because a call that cannot be attributed to an owner cannot be charged to anyone and cannot be refused to anyone — that boundary is the security model as much as the billing one.