Where your data goes

Short version: your API calls go directly to providers (OpenAI, Stripe, Resend…). Elding is never in the request path. We store and serve your HTTP API key values, but your traffic never passes through us.

In development

Your app ──────────────► Provider (OpenAI, Stripe…)
   │        direct call
   └─► Local proxy (127.0.0.1) injects the key, then forwards directly

The proxy runs locally on your machine (bound to 127.0.0.1). It injects the real key and forwards the request directly to the provider. Elding’s servers only ever see metadata (the names of the keys referenced), never the request body, query, or response.

In production

1. SDK fetches the API key once ──►  Elding (returns the value)
2. Your app calls the provider  ──►  Provider   (direct, Elding not involved)

There is no proxy in production. The SDK fetches the API key value once at runtime, then your application calls the provider directly. Elding is never in the request path.

The honest trust model

Elding stores and serves your HTTP API key values. To serve them, our servers can decrypt them using envelope encryption, AES‑256‑GCM, and a KEK in KMS. This is a managed model: Elding specializes in API keys, not other application secrets.

We say ✅	We never claim ❌
Your API requests never transit our servers	”We never see your keys”
Local proxy, direct calls	”Zero-knowledge”
We store and serve your API keys, never your traffic	”We never touch your keys”

We are transparent about this on purpose: the value Elding adds is keeping keys out of your code and out of your request path, not pretending we never hold them.

Getting started

Concepts

The Vault

Security

Where your data goes

The common misconception

In development

In production

The honest trust model

​The common misconception

​In development

​In production

​The honest trust model

The common misconception

In development

In production

The honest trust model