SecurityTrackr works out of the box with a built-in AI on Free, and Pro orgs get Advanced AI with nothing to configure. Bring Your Own Key (BYOK) is a Pro-only override for when that is not enough: you point the product at your own OpenAI, Anthropic, or Mistral account, and every generative AI request runs through your key instead of ours. Here is who it is for, how the billing works, and the five-minute setup.
When BYOK is the right call
Most orgs never need it. You reach for BYOK when your organisation has to control who processes its data, or wants AI spend on an account it already manages. Common reasons:
- Compliance and data residency. Your provider choice decides the data-processing terms, the retention policy, and the region. If a framework or a customer contract pins those, BYOK puts you in the driver's seat.
- Vendor control. You already have a contract (and a DPA) with a model provider, and you want SecurityTrackr to use it rather than a separate vendor relationship.
- Your own billing and model choice. The AI bill goes straight to your provider account, on an invoice you already manage. You set the spend limit, and you pick the model (a frontier model if you want the best possible output).
- No SecurityTrackr usage allowance. Your own key is not metered against a SecurityTrackr usage allowance. Provider quotas, model availability, safety limits, and the spend limit you set still apply.
BYOK is a Pro-only feature, and a single provider per org. Saving a new key replaces the old one, so switching from, say, OpenAI to Anthropic is one action, not a cleanup job. Once a key is saved it takes precedence over Advanced AI for everyone in the org.
Your provider, your bill, your limits
With BYOK, the AI usage bills directly to your own provider account, at the provider's rates, on an invoice you already manage. You stay in control of the two things that matter: the spend limit and the model. We do not meter usage against a SecurityTrackr allowance, but provider quotas, model availability, safety limits, and your provider's spend controls still apply. Set the monthly limit before you start, and raise it whenever you want more headroom.
You also choose which model runs. Want a frontier model for the richest findings? Use it. Prefer a fast, low-cost one for routine work? That works too. The balance between quality and cost is entirely yours to set.
Where your data goes
Once a BYOK key is active, requests are sent to the provider you chose, under that provider's terms. That is the whole point of BYOK: you decide whose infrastructure sees your data and under which contract. Nothing else about how SecurityTrackr works changes.
Semantic matching is a separate path: when enabled, its embeddings use a separate platform-managed Mistral path so vectors remain comparable across the register. BYOK changes the provider for generative AI, not that dedicated embedding path.
The five-minute walkthrough
In the app, the owner opens Account → AI and clicks Set up your own AI provider. A short guided flow walks through the whole thing:
- 1Pick a provider. OpenAI, Anthropic, or Mistral.
- 2Create and paste a key. Generate a dedicated key in the provider's console, then paste it in. We encrypt it before it is stored (more on that below).
- 3Choose a model. We pre-select a mid-range model for the best balance of quality and cost. Pick another if your key only has access to specific models.
- 4Set a spend limit. We link you straight to your provider's billing settings so you can cap the monthly usage before any real traffic flows.
- 5Test it. We save the key, then run a quick test call to confirm the key, the billing, and the model all work. You get a clear pass, or the provider's actual error if something is off.
If the test fails, the key still gets saved, and we show you the real reason (a wrong key, a model your account cannot use, or a spend limit already hit). Fix it and retry without starting over.
Which model to pick
Bigger models write richer findings and cost more per call. We pre-select a mid-range model per provider because it is the sweet spot for a risk register. Our picks:
| Provider | We recommend | Why |
|---|---|---|
| OpenAI | GPT-5.6 Terra | OpenAI's current recommended mid-range model for rich findings. |
| Anthropic | Claude 4.6 Sonnet | Excellent reasoning and writing, a favourite for detailed findings. |
| Mistral | Mistral Large | Strong model from an EU-based provider with EU data centres, our pick when data residency matters, and the EU option we offer on our managed Advanced AI tier. |
If your key is restricted to certain models, choose one of those in the wizard or on the AI tab. Picking a model your account cannot reach is the most common reason the test call fails.
How the key is stored, and how to keep it safe
On our side, the key is encrypted with AES-256-GCM under a key derived specifically for your organisation, before it is written to the database. It is never stored in plaintext, never logged, and never returned by the API. It is only decrypted in memory at the moment we make a request on your behalf.
On your side, treat it like any other production secret:
- Use a dedicated key for SecurityTrackr, so you can revoke it without breaking anything else.
- Set a monthly spend limit on the provider account before real traffic flows.
- Rotate or revoke the key if you stop using BYOK, or move away from SecurityTrackr.