Security and responsible use
Keeping keys safe and the abuse policy for apps that send user text.
- How do I protect my app from prompt injection?Treat untrusted text as data, limit what tools can do, confirm risky actions, and keep secrets out of prompts.How-to
- How do I stop one end user from getting my whole account suspended?Moderate input, track which end user sent each request, and block a user as soon as a warning header appears.How-to
- How does the abuse policy affect my app on the Model API?Your key acts for your account: end users' insults at the assistant count against you. Warning first, then a 24-hour pause.Policy
- If my account is suspended, what still works?Every Clatter Labs product is paused for 24 hours; Support stays reachable. Credits, plan, keys and data aren't touched.FAQ
- Is my traffic to the Model API encrypted?Yes. The API is HTTPS only, and the Privacy Policy describes encryption in transit and at rest.FAQ
- Should my app let users enter their own Clatter Labs key?It's possible (they'd also give their Account ID), but you'd handle their secrets. Store them encrypted and never log them.FAQ
- The Model API allows CORS. Does that mean I can call it from the browser?CORS is allowed, but a browser call exposes your key. Call the API from your server.FAQ
- What are the x-clatter-notice headers?x-clatter-notice: abuse_warning and x-clatter-notice-text mark a request that earned an abuse warning.Reference
- What does Clatter Labs keep when a strike is recorded?A short, redacted excerpt of the message (no code, no links), erased after 30 days, so an appeal can be reviewed.Policy
- What happens to the text I send to the Model API?It's processed to produce the reply and logged for billing; data use is covered by the Privacy Policy.FAQ
- What's the safest way to store Model API keys?Keep keys in a secret manager or environment variables on the server, one key per service, least permissions.How-to
- Which permissions should my Model API key have?Only models:invoke. Add account:read only if the same service needs to read your balance.FAQ
Still need help?
Tried the steps above and still stuck? Email us. We usually reply within the first hour, and always within 24 hours. A full support team is with you.
Infrastructure questions, or permanent deletion of your data
infrastructure@clatterlabs.xyzFor deleting your whole account or the data of one service.