# Security
URL: https://docs.munito.ai/security

Munito AI encrypts all API traffic with TLS, which terminates on Munito AI's own gateways. Each API key holds only the permissions that you give it. Munito AI holds no security certification today. The [trust center](https://trust.munito.ai) lists the controls that are in place.

## Encryption in transit [#encryption-in-transit]

- Each Munito AI host accepts HTTPS only. A plain HTTP request gets a redirect to HTTPS.
- Each host sends HSTS (`Strict-Transport-Security`) for the domain and its subdomains.
- TLS terminates on Munito AI's own gateways. Cloudflare provides only DNS for Munito AI's domains, and it does not receive or decrypt your requests.

Check the HSTS header of a host:

```bash
curl -sI https://api.eu.munito.ai/inference/v1/models | grep -i strict-transport-security
```

The command prints `strict-transport-security: max-age=31536000; includeSubDomains`.

## API keys and permissions [#api-keys-and-permissions]

Create keys on [API keys in the console](https://console.munito.ai/keys). The console shows the secret of a key once. Keep the key on your server, never in client code or in a repository.

| Permission   | Lets the key                                                                                                             |
| ------------ | ------------------------------------------------------------------------------------------------------------------------ |
| `inference`  | Call the inference API at `https://api.munito.ai/inference/v1`.                                                          |
| `admin:read` | Read the organization, members, keys, usage, spend limits and models through the [Admin API](https://docs.munito.ai/administration). |

A key holds one permission or both. Only owners and admins can give a key `admin:read`. Use one key for each job, so that a reporting key cannot spend.

A key without the permission gets `403` with this message:

```text
This API key does not have the admin:read permission.
```

Send the key in the `Authorization: Bearer` header or the `X-API-Key` header. Keep it in the environment variable `MUNITO_API_KEY`:

```bash
pip install openai
export MUNITO_API_KEY="munitoai_..."
```

```python
import os
from openai import OpenAI

client = OpenAI(
    base_url="https://api.munito.ai/inference/v1",
    api_key=os.environ["MUNITO_API_KEY"],
)
print([model.id for model in client.models.list()])
```

If a key is exposed, revoke it in the console at once, and create a new one. A member can revoke the keys that it created. Owners and admins can revoke every key of the workspace.

## Console accounts [#console-accounts]

- Sign in with email and password, or with Google or GitHub.
- Munito AI stores passwords as hashes.
- A verified email gives access to the console. A phone verification and automatic abuse checks activate the free tier.
- Bot protection runs at sign-up, sign-in, phone verification and on the contact and support forms.

## MCP server [#mcp-server]

The [MCP server](https://docs.munito.ai/mcp) lets an AI assistant read your account data. It can also create API keys, but only when you allow it at sign-in. It cannot revoke a key, change a limit, or delete data. Disconnect an app on the MCP page of the [console](https://console.munito.ai), and it stops at once.

## Report a vulnerability [#report-a-vulnerability]

Send a vulnerability report to security@munito.ai. The website, console, docs, legal and trust hosts publish this contact in `/.well-known/security.txt` ([RFC 9116](https://www.rfc-editor.org/rfc/rfc9116)), for example [docs.munito.ai/.well-known/security.txt](https://docs.munito.ai/.well-known/security.txt).

Get permission before a test that can affect other users or the availability of the service.

## Certifications [#certifications]

Munito AI holds no security certification and no audit report today. Certifications and audits are planned. SSO and SCIM are planned too.

The [trust center](https://trust.munito.ai) lists the controls that protect customer data today, and the sub-processors of each region. The [Data Processing Agreement](https://legal.munito.ai/dpa) states the security terms of the processing.

## Related pages [#related-pages]

- [Data privacy](https://docs.munito.ai/data-privacy)
- [GDPR and EU data residency](https://docs.munito.ai/gdpr-data-residency)
- [Administration](https://docs.munito.ai/administration)