Discoball Chat

Security & your API key

How we protect the key you connect, in plain terms. Discoball Chat is operated by Liminal Abundance and is currently in alpha; we update this page as the security model evolves.

The short version. Your API key is encrypted with a key that's unique to your account. It's never shown to you again, never sent back to your browser, never sold, and never shared. You can delete it beyond recovery the moment you ask — and for total peace of mind, you can connect a spend-limited key so even a worst case is capped at a few dollars.

Why we ask for a key at all

Discoball Chat doesn't run one shared AI. Each person brings their own — so no single system sits in the middle of your conversations. To run your side of a message (shaping what you send, translating what you receive), the app calls your AI provider using your key. That's the only thing it's ever used for.

How your key is stored

Encrypted at rest with AES‑256‑GCM — a modern, authenticated cipher (tampering is detected, not silently decrypted).
A key unique to your account. Every account gets its own random data key, and your API key is encrypted under that. So there's no single value that reveals everyone's keys in one step, and one account's data can't be read without unwrapping that account's own key.
The encryption key lives outside the database. A stolen copy of the database is unreadable on its own — the material needed to decrypt isn't in it.
Never shown again. After you connect, the app only ever displays the last 4 characters (like •••• a1b2). The full key is never sent back to your browser, never written to logs.

How your key travels

When the app calls your AI provider, it connects over HTTPS (an encrypted connection) and sends your key only to that provider — Anthropic, OpenAI, Google, or OpenRouter, whichever you chose. We don't route it anywhere else, and we don't log it along the way.

Deleting your key

Removing your key — or deleting your account — crypto‑shreds it: the account's unique encryption key is destroyed, which makes your stored key mathematically unrecoverable, instantly, without affecting anyone else. It's not "marked deleted" — it's gone.

Account protections

Sign‑in is rate‑limited to stop password‑guessing.
Passwords are stored only as slow, salted scrypt hashes — never in plaintext.
Session cookies are HttpOnly, SameSite=Strict, and Secure — resistant to theft and cross‑site request forgery.
Every page ships a strict Content‑Security‑Policy and anti‑clickjacking headers.

Our honest recommendation

For maximum peace of mind, create a usage‑limited key with a low monthly spend cap in your provider's dashboard, and connect that. Every major provider supports it. Then even in the worst imaginable case, your exposure is capped at a few dollars — and you can revoke it any time from your provider, independently of us.

What we're honest about

To translate a message while you're offline, our server has to briefly use your key in memory — that's true of any service that calls an AI on your behalf. What matters is what surrounds that moment: encrypted the rest of the time, per‑account isolation, never logged, never shown, never sold. We're also building toward a hardware‑backed key vault so that even a breach of our own servers couldn't decrypt stored keys; the per‑account design above is the foundation for it.

Found something?

If you believe you've found a security issue, please tell us via the contact form — we take it seriously and will respond quickly. Discoball Chat's protocol code is open source and public for anyone to inspect.