Security

This document describes authentication, secret handling, data isolation, and security responsibilities when using Acklix.

Authentication

All Acklix APIs are authenticated using an API key. Access tokens and OAuth-based authentication are not supported.

Authorization: Api-Key YOUR_API_KEY
  • API keys are scoped to a workspace
  • Keys must be stored server-side
  • Keys should never be embedded in client-side code

Secrets and Credentials

Secrets are used by tools and data sources to authenticate with external systems.

Secrets are encrypted at rest and isolated per workspace. They are never exposed in API responses or logs.

  • Database credentials
  • Third-party API keys
  • Service account credentials

Data Security

Context sources introduce external data into model execution. Data is read-only during inference.

  • Structured data is validated against schemas
  • Invalid records are rejected during ingestion
  • Database access should be restricted to required tables

Sensitive Information

Acklix does not persist inference inputs or outputs unless explicitly configured by the user.

  • Avoid sending sensitive personal data unless required
  • Redact sensitive fields before ingestion
  • Ensure application logs do not store model outputs

Deployment Isolation

Deployments are isolated execution environments associated with a specific model version.

  • Deployments are referenced by deployment ID
  • Inactive deployments cannot receive inference requests
  • Deleting a deployment disables execution immediately

Shared Responsibility Model

  • Acklix secures infrastructure and execution boundaries
  • Users are responsible for API key storage and rotation
  • Users control what data is sent to models