Bring Your Own Key (BYOK)
Enterprise organizations can run the platform's AI features on their own AI provider API key — OpenAI, Anthropic, Google Gemini, OpenRouter, Groq, Mistral and other OpenAI-compatible providers, or a custom OpenAI-compatible endpoint. Your organization admin manages it under Settings → BYOK.
What runs on your key
| Surface | On your key? |
|---|---|
| Chat (Ellie) — every model call in a turn, including thread titles and summaries | ✅ Yes |
| Workflow runs — every node's model calls | ✅ Yes |
| Single-node execution and guided inputs | ✅ Yes |
| Semantic graphs and file summaries (file analysis) | ✅ Yes |
| Semantic indexing of your files and captures (embeddings) — OpenAI provider only | ✅ Yes |
Calls made on your key consume no platform credits; you pay your provider directly.
File analysis uses structured output (JSON schema). If your provider or selected model does not support it, uploads still work but files get no summary or concept graph.
What stays on the platform provider
These features are technically bound to the platform's provider and keep running on the platform key. While BYOK is enabled they consume no credits — the platform absorbs them. They are listed so your security team has the exact boundary:
| Surface | Why it stays on the platform key |
|---|---|
| Document parsing (OCR of images inside PDFs, Word, PowerPoint, Excel) | Vision model |
| Framework Explorer search-box queries | The framework/course catalogues are platform reference data embedded with the platform model — only your short search string is embedded, never document content |
| Web search inside workflow nodes | Provider-native search tool — unavailable while BYOK is enabled; nodes run without it |
Semantic search under BYOK
The platform's semantic features all use one embedding model
(text-embedding-3-small). There is nothing to configure — which provider
you choose decides whether they run, and on whose key:
- OpenAI: semantic indexing of your files and captures runs on your key, and every semantic feature stays available — search over your content, Course recommendations, Framework mapping.
- Any other provider: file and capture uploads keep working, but semantic search over them is turned off, and Course recommendations and Framework mapping are hidden — those features are built on the platform's pre-embedded catalogues, which other providers cannot query. Your content is never sent to the platform provider for embedding as a fallback.
Switching providers strands nothing: your existing index stays valid, and switching back to OpenAI (or disabling BYOK) restores semantic search over it within a minute. Enabling OpenAI also runs an embeddings connection test, so a key without embeddings access cannot enable and then fail every upload.
Observability
BYOK changes which provider performs inference. It does not change the platform's LLM-observability pipeline: prompt and completion content, token usage and user identifiers for BYOK traffic are still captured by our observability tooling for quality and incident diagnosis, under the same terms as platform-key traffic. See the security documentation for subprocessor details.
Behaviour you should know about
- No silent fallback. If your key is revoked, your provider rejects a request, or your BYOK entitlement lapses, requests fail with a message naming your provider — they are never quietly re-routed to the platform key. An org admin can fix the key in Settings → BYOK or disable BYOK to return to the platform provider.
- Enabling runs a connection test against the saved key and chosen model; a failing test does not enable BYOK.
- Changes take effect within a minute across all platform servers.
- Removing a key requires disabling BYOK first, so your traffic never moves back to the platform provider as a side effect of credential hygiene.
- Hourly ceiling. Because own-key calls bypass the credit pool, an organization-wide ceiling on AI requests per hour protects shared platform capacity. If reached, requests wait and resume automatically within the hour; contact support to raise it.
- Suggested models in the provider picker are a starting point; the live model list from your provider is preferred and any model id can be typed in.
- Key handling. The key is encrypted at rest, shown only as its last four characters, and never returned by the API.