Privacy & security
A practical overview of what the platform stores and where evaluation data goes.
Account and workspace data
allevals stores the email address and name you provide, workspace configuration, API-key metadata, and evaluation history. Sign-in uses time-limited email links and revocable sessions. Full allevals API keys are shown only once; only their hashes are stored.
Endpoint credentials
Endpoint API keys and custom header values are encrypted at rest. They are used to send the evaluation requests you initiate to your configured endpoint. Saved secrets are not returned to the browser, and replacing a value replaces the stored secret.
Evaluation data
Running an evaluation sends the selected benchmark inputs to your configured endpoint. The platform retains run and task identifiers, status, scores, timing, token counts, fixed error codes, and cost metadata. Execution inputs, expected answers, model outputs, reasoning, and decision-response traces are not retained in run records, the results API, dashboard, or metadata exports. Benchmark source packages and license notices are separate from execution records. Your endpoint provider’s own terms and data policies still apply to the requests it receives.
Email and payments
Configured email delivery sends sign-in links through the deployment’s email provider. When enabled, Stripe handles checkout and payment information. allevals stores billing identifiers, verified wallet payments, and subscription status—not full payment-card details.
Security controls
Workspace access is checked on the server. API keys can be scoped and revoked. Browser sessions can be reviewed and revoked from account settings. Endpoint validation rejects private-network destinations and unsafe request headers.