Bring your own AI key — and what still leaves your device

DoctorVault is bring-your-own-key. You paste an Anthropic or OpenAI key into vault Settings. It is stored inside the encrypted vault snapshot and used browser-direct. The key never hits doctorvault.ai.

That is the point of BYOK: we are not a proxy, we cannot meter your tokens, and we cannot read the prompts. It also means the product is free of our model bill — you pay your provider.

When you run a panel consult, the browser sends the question plus retrieved record excerpts to the LLM API you configured. That vendor sees whatever we send them in that request.

If you use embeddings (Pro semantic search), an embedding provider sees the text you index. Storage providers (Drive, S3, R2, B2) see ciphertext, not plaintext records.

The honest sentence is not “nobody ever sees your data.” It is: we cannot see it; your storage provider sees ciphertext; your AI provider sees consult context.

• Use a key you created for this vault, not a shared team key.
• Turn on your provider’s retention / training opt-outs where they exist.
• Prefer GP quick-answer when you do not need a full debate — fewer specialists, less context.
• Do not paste secrets (SSNs, full insurance IDs) into records if you can avoid it.
• Confirm the network tab: traffic for chat should go to your provider, not to our origin. Steps are on /security.

A hosted “AI doctor” that pays for tokens for you has to see prompts, or bill through a proxy that sees prompts. We refused that. You keep the relationship with Anthropic or OpenAI. We keep the job of not holding your file.

If that trade is unacceptable — you want zero vendor-visible context — do not use panel chat. The vault, records, files, and reminders still work without an AI key.