Operating

Connections & BYOK

Your provider accounts, your rate limits, your data agreements.

Why bring your own keys#

Running on your provider account means your negotiated pricing and rate limits apply, your usage appears on your provider bill for reconciliation, and your data-processing agreement with that provider is the one in force. There is no Vectorbea markup on tokens because the tokens are never ours.

How keys are stored#

• Encrypted with AES-256-GCM under a per-workspace data key before they touch disk.

• Decrypted only inside the runner process that makes the call — never in the browser, never in the control plane.

• Never displayed again. You can replace a key; you cannot read it back.

• Excluded from logs, traces and run payloads by construction rather than by redaction.