AI Providers and Data Security

Overview

This document discusses the data flow of your API key from the moment you activate an AddOn with AI functionality within your Beefree SDK Developer Console. In this document, you learn more about Beefree SDK’s security practices, frameworks, and protocols in reference to protecting your sensitive data assets.

Data Flow Diagram

The following diagram provides a visualization of the data flow for your AI AddOn API key. In the following diagram, OpenAI is shown as an example. However, this same flow applies to other AI provides available through Beefree SDK AddOns.

These providers include:

• Azure OpenAI

• Azure Cognitive Vision

• DeepL

• Stability AI

This data flow diagram illustrates the flow of data and the key components involved in securing the API key from developer input to end user interaction.

The following list shows each component within the data flow diagram along with the component’s description.

• Developer Console: This is where the developer inputs the API key, initiating the process.

• AI AddOn: This is where the developer enters their API key that they received from their AI Provider, and activates the AddOn for their host application.

• Data Store: The encrypted API key is stored securely in the data store.

• End User: The end user interacts with the host application.

• HA AddOn: The frontend user interface of the AI AddOn that the end user engages with.

• Proxy: The proxy receives and forwards requests to the API, and sends responses to the AI AddOn within the host application.

• AI Provider: The AI Provider processes requests and provides responses.

Data Management Details

The flow and management of your API key is designed to ensure its security. Security measures are implemented as soon as you enter your API key into the Developer Console. Once you enter your API key, it is immediately encrypted over TLS. From there, the encrypted API key is securely stored in the Beefree data store. Your API key remains encrypted both at rest and during transit.

When the end user types a prompt into the AddOn, their prompt is forwarded through a proxy. The proxy receives the request, retrieves the API key, and forwards both the API key and the prompt to the AI Provider. The AI Provider processes the request and forwards the response to the proxy. The proxy then delivers the response to the AI AddOn, which displays the response in your application’s frontend to the end user.

Note: The proxy does not log any personal data and only facilitates secure communication from request to response. Throughout this process, the API key remains in the backend, preserving its security and ensuring no personal data is processed by the application. This approach is GDPR compliant.

For additional information, we recommend you reference our Terms of Service and our AIF third-party providers' policies.