Security
TokenToko holds access tokens to your AI subscriptions, so security is the core of the product. This page explains how we protect them, what you can do yourself and how to report a problem to us.
1. Your subscription tokens
In short: encrypted, kept on systems the internet can’t reach, and handed out only to computers you allowed.
You sign in at the provider, not with us. When you connect a subscription, a disposable container runs the provider’s own sign-in tool and you sign in in your own browser. That container can reach only the provider’s sign-in and API addresses, and it is destroyed afterwards. We never see your provider password.
Encrypted at rest. Tokens are encrypted with AES-256-GCM before they are stored. Our database and backend are not reachable from the internet.
Handed out for a limited time. A computer receives a token only if it may use that subscription, and only for a limited lease that it must keep renewing.
Deleted when you remove them. Removing a subscription deletes its token from our database straight away.
Your prompts stay off our servers. The relay on your computer sends requests straight to the provider, so the content of your work never passes through TokenToko.
2. Your computers
In short: each computer has its own key, and you can cut any computer off at once.
Each computer creates its own key pair when you connect it. The private key never leaves the computer. On Windows it is created as a key the system won’t export.
Requests from computers are signed with that key.
We alert you when a computer appears in a new country, which can be a sign that its key was copied.
You can revoke one computer, or all of them, in the dashboard. A revoked computer stops receiving tokens straight away.
Only the owner of a computer can collect its logs or send it remote actions.
Tokens and keys are removed from the computer’s events and logs before they are sent, and again on our servers.
The app checks the signature of each update before it installs it.
3. Your account and team
In short: strong sign-in, clear roles and a record of changes.
You sign in with Google, Apple or Microsoft. Turn on two-step verification in that account; it protects your TokenToko account too.
Team roles limit who can add subscriptions, mint keys, manage computers and handle billing. Members can look but not change.
API keys and join tokens are shown once and stored only as fingerprints.
The team activity log records who changed what.
4. What you can do
In short: keep computers, keys and sign-in accounts secure.
Connect only computers you control and keep them updated. Anyone who controls a connected computer can use the subscriptions it can reach.
Use API keys only in secret stores, never in code or chat messages.
Share a subscription only with the people and agents who need it, and lock it to them in the dashboard.
Review your computers and keys from time to time and revoke what you no longer use.
5. If something leaked
In short: revoke first, then tell us.
A computer: revoke it in the dashboard under Settings, then Computers.
An API key or join token: revoke it in the dashboard under API Keys.
A subscription token: remove the subscription in the dashboard, which deletes our copy, and end the token at the provider by signing out of its sessions or revoking it in your provider account. Then connect the subscription again if you want to keep using it.
Your sign-in account: secure it with Google, Apple or Microsoft, then check your TokenToko teams, computers and keys.
Tell us at security@tokentoko.ai, so we can check for related activity.
6. Reporting a vulnerability
In short: email security@tokentoko.ai. We won’t take action against good-faith research.
If you find a security problem in TokenToko, write to security@tokentoko.ai. Please include what you found, how to reproduce it and what an attacker could do with it. We aim to reply within three working days and to keep you informed until it is fixed.
When you research TokenToko:
use only accounts, teams, computers and subscriptions that are yours;
don’t access, change or delete other people’s data, and stop as soon as you see any;
don’t run denial-of-service tests, social engineering or physical attacks;
don’t test against AI provider accounts that aren’t yours;
give us reasonable time to fix the problem before you publish it, normally 90 days.
If you follow these rules in good faith, we won’t take legal action against you for your research. We don’t run a paid bug bounty, but we will credit you if you want.
7. Our promise if something goes wrong
In short: we tell you.
If a security incident affects your data, we tell you without undue delay, explain what happened and what we are doing about it, and inform the regulator where the law requires it.