Policies and security

Provider key isolation

The Jina provider key stays in the server environment. Clients authenticate with a separate Chatsax key. Requests are routed to known provider endpoints; this is not an unrestricted HTTP proxy.

Scoped access

Generated keys are stored as hashes and listed with prefixes. The gateway checks scopes, per-key request limits, and ownership of classifier and batch resources. Administrator endpoints require administrator access.

Application boundaries

The gateway limits request size and upstream destinations. Reading a public page still exposes your submitted URL and extraction options to the provider. This page does not claim an independent security audit, certification, or that all provider risks have been eliminated.

Report a concern

Use the Contact form with the Security category to report concerns privately. Public GitHub issues are suitable for non-sensitive bugs only. Revoke a potentially exposed key before continuing work.

Access and credentials

Register with a verified email or a supported identity provider. Keep your password and API keys confidential, and access only resources you are authorized to use. You can revoke exposed keys from your account.

No login required · Use this key right away. Sign in to manage your account.

Your inputs and use

You are responsible for having the rights and permissions needed to submit content and use the resulting output. Do not use the service to access another person’s private resources without authorization, disrupt services, or violate applicable law.

Third-party services

Jina currently supplies upstream search and model APIs. Outputs may be incomplete, inaccurate, or unavailable. Verify important results against original sources. Published model-weight licenses are separate from hosted API access.

Usage and availability

Token packs are prepaid, with price and settlement currency shown before checkout. Verified payments credit your account; requests consume provider-reported tokens. Unsettled requests may reserve balance. Automatic recharge is off by default and requires a saved card and explicit authorization for the pack, threshold and daily cap. Disable it from Billing to stop new automatic charges. This service does not promise uninterrupted availability or an SLA. Statutory consumer rights are unaffected.

Project identity

Chatsax is an independent project. Third-party model names and links identify providers and reference materials; they do not imply affiliation, endorsement, or ownership of the original research.

Data you submit

API inputs, URLs, documents, images, and request options are processed by Chatsax and forwarded to the selected upstream provider to deliver the requested service. Do not submit information you are not authorized to share.

Operational records

The gateway records key identifiers, routes, model names, response status, latency, and available token usage. Application usage records do not intentionally store prompt or document bodies. The dashboard currently queries a 30-day reporting window; this is not an automatic deletion promise.

Local device storage

Language and theme preferences are saved locally. Account sessions use an HttpOnly cookie. Manually connected API keys are kept in session storage, or local storage when Remember is selected. Log out or disconnect to remove local access. No advertising or analytics cookies are installed.

Anonymous API access uses an essential cookie and a random device identifier to restore your key. Hashed network identifiers limit trial issuance.

Service providers

Cloudflare hosts the application, accounts and billing ledger. Jina processes API inputs. Resend delivers verification and reset emails. Stripe processes card payments and stores saved card details; Chatsax receives payment identifiers and limited card metadata, not full card numbers. Alipay and WeChat payments use the configured payment gateway. Google or GitHub supply verified identity details if selected. Each provider applies its own data policies.

Questions and requests

Use the contact form for account, billing and data-handling requests. Include the relevant order or request identifier and never include passwords or API keys.