Storage
- At rest — encrypted with a per-workspace key, stored server-side in
data/userSettings/{userId}.json. - In transit — passed to Anthropic via HTTPS, never logged.
- In memory — decrypted only for the duration of an LLM call.
Rotation
Replace the key at any time via AI Studio → LLM Configuration → API key. New key takes effect immediately for new calls.Multiple keys
Not currently supported. One key per user. Workspace admins can require members to bring their own key.What Xura doesn’t do
- Doesn’t hard-code any fallback key.
- Doesn’t proxy your traffic through Xura’s account.
- Doesn’t share keys across users.