How We Handle Your API Keys

Where Is My API Key Stored?

• Stored in your browser's localStorage
• Automatically expires after 24 hours
• Never stored on Business Diver's servers
• You can delete it anytime by clicking "Delete Key" in the research tool

What Happens During a Research Request?

What We Never Do

• Never log your API key
• Never write it to disk or database
• Never share it with third parties
• Never include it in error messages
• Never use it for anything except your requested research

How Does Bring Your Own Key (BYOK) Work?

You create an API key with an AI provider and paste it into Business Diver. It is stored only in your browser. Your AI usage goes on your own provider account, under the provider's pricing and terms. You maintain full control and can revoke the key anytime from the provider's dashboard.

What If My Key Is Compromised?

1. Revoke it immediately in your AI provider's dashboard
2. Generate a new key
3. Business Diver has nothing to revoke because we never stored it

Is It Safe to Use My API Key with Business Diver?

Yes. Your API key is stored in your browser with 24-hour auto-expiry. It is transmitted over HTTPS only during active requests. Your key exists in server memory only for the duration of one API call, then it is discarded. Our database holds your account details only: never your API keys, and not your reports, which stay in your browser.

• HTTPS-only transmission (never in URLs)
• Content Security Policy restricts outbound connections
• CORS locked to businessdiver.com
• Rate limits on every research, key-check and account request

For full legal details, see our privacy policy.

Managed Keys (Coming Soon)

Pro and Business plans with a managed Gemini key are coming soon, so you will not need a key of your own. A managed key will stay on our backend, never in your browser, and the same rule will apply as for your own key today: a key is used only for the research you request and is never logged or shared with third parties.