# Security and privacy
How to keep API keys safe, where Skybox AI hosts data, and how to reach us about privacy.
Legal detail: Privacy Policy (opens new window) and Terms on blockadelabs.com (opens new window). Account help: Support.
# API keys
- Create and manage keys at skybox.blockadelabs.com/api (opens new window).
- Call the API from your backend or an official SDK on the server. Do not put a key in frontend JavaScript, mobile apps, game clients, or public repos.
- Prefer the
x-api-keyheader. Theapi_keyquery parameter can leak into logs, proxies, and browser history. - Store keys in a secret manager or environment variables. Do not commit them.
- If a key is exposed, revoke it and create a new one.
- Account pending / concurrency caps do not cap spend. Enforce app generation limits before you call the API. App generation limits
Do not paste keys into chat
Never paste your API key into AI chat apps, prompts, tickets, or shared conversations.
# Webhooks
When you use webhook_url, verify x-timestamp and x-signature with your API secret. See Wait for completion.
# Accounts (web)
Skybox AI uses passwordless login (magic link, Google, or X). Discord OAuth is not supported. Your email identifies your account. See Account and login.
# Data residency and hosting
Free evaluation, Individual (Essential, Standard), and Business run in the United States. Those plans do not offer non-US hosting or a customer-chosen region.
Custom data residency (including non-US hosting) is Enterprise only. Contact sales on plans (opens new window) or Support.
| Plan | Hosting |
|---|---|
| Free evaluation, Essential, Standard, Business | United States |
| Enterprise | Custom options by agreement |
# Encryption
- API and web traffic use HTTPS with modern TLS. Older SSL and TLS versions are disabled.
- Customer content and credentials are encrypted in transit and at rest.
Detailed cipher lists, key management diagrams, and full security questionnaires are available for Enterprise under NDA. Start with Support or Contact sales on plans (opens new window).
# Privacy
| Need | Contact |
|---|---|
| Privacy Policy | blockadelabs.com/privacy (opens new window) |
| Data deletion or privacy requests | personaldata@blockadelabs.com |
| Product or security questions | support@blockadelabs.com |
| Legal | legal@blockadelabs.com |
# Generations and training
On Business, IP protection means your generations are not used to train our models. See Plan comparison. License rights depend on your plan. See plans (opens new window) and the product Terms.
# Image metadata
Downloaded skybox files include GPano camera metadata. They do not yet include IPTC AI labels or C2PA Content Credentials. That labeling work is on the Roadmap. For tracking, use the generation ID from the API. Details: Image metadata.
# What we collect
We collect account email (login and identity) and data needed to run generations and store skyboxes. That includes prompts, uploads, and generated assets used to provide the service. Categories and rights are in the Privacy Policy.
# Public service domains
| Use | Domain |
|---|---|
| API | backend.blockadelabs.com |
| Images and assets | images.blockadelabs.com, assets.blockadelabs.com |
| Web app | skybox.blockadelabs.com |