Bring your own model keys
EvaliQA never stores its own API keys to model providers. Your keys are scoped to a workspace, encrypted at rest with AES-256-GCM in the LLM Gateway and only decrypted in memory at request time.
Security
Model access, evidence and infrastructure — under your control.
EvaliQA is built so an evaluation platform never becomes another place where sensitive credentials, prompts or user data quietly accumulate.
Workspace isolation
Every project, dataset, run and trace lives under a workspace. Access is JWT-scoped by workspace and role; there are no cross-workspace queries and no shared storage buckets.
Self-hosted option
The same service set that runs the hosted product deploys inside your perimeter with your Postgres, ClickHouse and object storage. No mandatory outbound call to an EvaliQA cloud.
Evidence you can audit
Every evaluation and trace exports in an open, inspectable format. Retention is per plan; deletion of a workspace removes the associated data from Postgres, ClickHouse and MinIO.
Operational controls
What we do every day.
- Role-based access: OWNER, ADMIN, MEMBER inside every workspace.
- Owner-only billing and destructive actions; audit log on Enterprise.
- Traefik-fronted routing — no direct exposure of internal services.
- Secrets injected via environment, never checked into version control.
- Password reset, email verification and workspace invites via signed tokens.
- Runtime traces exportable at any time; deletion is a first-class operation.
For security disclosures, contact security@qamentor.com.