Security & key custody

Last revised July 29, 2026

Cortya ("Cortya," "we," "us," or "our") reads your Anthropic organization with a read-only Admin API key. That key can see your whole organization's usage, so it is the one thing we protect above all else. Cortya is built so that a breach of our database — or our logs — never exposes it.

The plaintext of your Admin key exists in exactly two places: Azure Key Vault, and transient server memory for the moment we call Anthropic. It is never in our database, never in a log line, never in an HTTP response, and never in an audit record.

Key custody model

Encrypted at rest in Azure Key Vault. Your key is stored as a secret in Azure Key Vault, which envelope-encrypts secrets at rest under HSM-protected keys. We operate the vault; the plaintext is written to it and read from it only by our server.
Decrypted server-side only, transiently. When Cortya needs to read your usage, the server fetches the key from Key Vault into memory, makes the read-only Usage & Cost API call, and discards it. The key never leaves the server and is never returned to your browser.
Never logged. Our logging redacts secrets; any sk-ant--shaped material is stripped before a log line is written. The key never appears in error messages, traces, or audit detail.
The database holds only a pointer. Our application database stores the Key Vault secret's name, the last four characters (for display), and status metadata — never the key. A dump of our database yields no usable credential.
Validated before storage. A newly connected or rotated key is verified against the Anthropic Admin API before anything is stored, so a bad key can never overwrite a working one.
Every access is audited. Each time the plaintext is read from the vault to make a call, we record an audit entry attributable to your organization.

Tenant isolation

Each organization's key is stored under its own vault secret, and every data query is scoped to your organization. One customer's key or data is never used to serve another. The application connects to the database as a least-privilege role — it cannot alter schema or reach other tenants' rows outside its scoped queries.

Authentication

Sign-in is passwordless: you receive a one-time code and link by email that expire quickly. The at-rest hashes of those codes are peppered, and session and CSRF state ride signed cookies. There are no passwords for an attacker to steal or reuse.

Data in transit and at rest

All traffic is served over HTTPS. Secrets are kept out of source control and configuration; the application reads them through a single validated accessor fed from Key Vault at deploy, and refuses to start if required secrets are missing or malformed.

How to revoke your key

You are always in control:

From Cortya: use the "Revoke" action on your dashboard's Admin-key panel. This removes the stored key material and stops all further access immediately.
From Anthropic: rotate or delete the Admin key in your Anthropic account. Cortya's copy stops working at once; reconnect with a new key when you're ready.

Reporting a concern

Found a security issue or have a question about this model? Email hello@cortya.com and we'll respond promptly.