Security by Architecture, Not Just Policy

1. Zero API Key Custody Commitment

When you run prompt evaluation suites using our CLI (`gitforprompts run test-suite`), the evaluations execute 100% locally within your workstation process. The CLI communicates directly with LLM inference providers (such as Groq, Anthropic, OpenAI, or OpenRouter) using the API keys configured in your local environment variables.

Your third-party LLM API keys are never transmitted to, processed by, or logged on Git for Prompts servers. They remain strictly in your local shell session memory.

2. Local-First SQLite Repositories

By default, Git for Prompts creates a local `.gitforprompts/` directory containing an embedded SQLite database. All version snapshots, commit logs, test assertions, and prompt templates are written directly to your local file system.

You maintain full sovereignty over your local prompt repositories. You can operate completely offline, keep repositories air-gapped, or commit the `.gitforprompts/` bundle into your internal version control systems without interacting with our cloud infrastructure.

3. Cloud Sync & API Key Storage

If you optionally choose to synchronize your prompt bundles to the Git for Prompts cloud platform (`gitforprompts push`), your prompt templates, version descriptions, and test definitions are stored in an encrypted PostgreSQL database protected by Clerk user authentication and row-level access controls.

When you generate a Git for Prompts API key to deliver prompts to production backend systems:

• The raw plaintext API key is shown to you exactly once upon generation.
• The database stores only a non-reversible cryptographic hash generated with SHA-256 (`crypto.createHash('sha256')`).
• Neither our engineers nor any automated process can reverse or recover your raw API key.

4. Analytics & Cookies

We use Vercel Analytics and Speed Insights to track aggregate Core Web Vitals (FCP, LCP, CLS) and improve website performance. These analytics do not use tracking cookies, do not track you across other domains, and are strictly privacy-preserving. Authentication session cookies are managed securely via Clerk with HTTP-only and SameSite flags.