Encryption in transit, API key permissions, account checks, vulnerability reports and certification status.
Munito AI encrypts all API traffic with TLS, which terminates on Munito AI's own gateways. Each API key holds only the permissions that you give it. Munito AI holds no security certification today. The trust center lists the controls that are in place.
Encryption in transit
- Each Munito AI host accepts HTTPS only. A plain HTTP request gets a redirect to HTTPS.
- Each host sends HSTS (
Strict-Transport-Security) for the domain and its subdomains. - TLS terminates on Munito AI's own gateways. Cloudflare provides only DNS for Munito AI's domains, and it does not receive or decrypt your requests.
Check the HSTS header of a host:
curl -sI https://api.eu.munito.ai/inference/v1/models | grep -i strict-transport-securityThe command prints strict-transport-security: max-age=31536000; includeSubDomains.
API keys and permissions
Create keys on API keys in the console. The console shows the secret of a key once. Keep the key on your server, never in client code or in a repository.
| Permission | Lets the key |
|---|---|
inference | Call the inference API at https://api.munito.ai/inference/v1. |
admin:read | Read the organization, members, keys, usage, spend limits and models through the Admin API. |
A key holds one permission or both. Only owners and admins can give a key admin:read. Use one key for each job, so that a reporting key cannot spend.
A key without the permission gets 403 with this message:
This API key does not have the admin:read permission.Send the key in the Authorization: Bearer header or the X-API-Key header. Keep it in the environment variable MUNITO_API_KEY:
pip install openai
export MUNITO_API_KEY="munitoai_..."import os
from openai import OpenAI
client = OpenAI(
base_url="https://api.munito.ai/inference/v1",
api_key=os.environ["MUNITO_API_KEY"],
)
print([model.id for model in client.models.list()])If a key is exposed, revoke it in the console at once, and create a new one. A member can revoke the keys that it created. Owners and admins can revoke every key of the workspace.
Console accounts
- Sign in with email and password, or with Google or GitHub.
- Munito AI stores passwords as hashes.
- A verified email gives access to the console. A phone verification and automatic abuse checks activate the free tier.
- Bot protection runs at sign-up, sign-in, phone verification and on the contact and support forms.
MCP server
The MCP server lets an AI assistant read your account data. It can also create API keys, but only when you allow it at sign-in. It cannot revoke a key, change a limit, or delete data. Disconnect an app on the MCP page of the console, and it stops at once.
Report a vulnerability
Send a vulnerability report to security@munito.ai. The website, console, docs, legal and trust hosts publish this contact in /.well-known/security.txt (RFC 9116), for example docs.munito.ai/.well-known/security.txt.
Get permission before a test that can affect other users or the availability of the service.
Certifications
Munito AI holds no security certification and no audit report today. Certifications and audits are planned. SSO and SCIM are planned too.
The trust center lists the controls that protect customer data today, and the sub-processors of each region. The Data Processing Agreement states the security terms of the processing.
Related pages
Data privacy
The Munito AI API keeps no prompts or outputs by default and does not train models on your data. See what it stores only when you ask, and for how long.
Scaleway vs Munito AI
Scaleway Generative APIs and Munito AI side by side for open models in the EU: regions, APIs, OCR, decision models and prices.