SecurityTrackr works out of the box with a built-in AI on Free, and both paid plans get Advanced AI with nothing to configure. Bring Your Own Key (BYOK) is a paid-plan override for when that is not enough: you point the product at your own OpenAI, Anthropic, or Mistral account, and every generative AI request runs through your key instead of ours. Here is who it is for, how the billing works, and the five-minute setup.
Use your own provider account
BYOK is for organisations that want their own provider contract, billing account or model choice. It is available on Pay-per-use and Pro. One provider key applies to the whole organisation and takes precedence over managed Advanced AI.
Your provider account determines the processing and retention terms for generative requests. Optional semantic matching uses a separate platform-managed Mistral service. Saving or replacing your BYOK key automatically turns semantic matching off and deletes its stored vectors. You can enable it again manually in AI settings after confirming that separate data flow. See where your AI data goes.
Your provider bill and SecurityTrackr credits
With BYOK, you pay your provider directly for model usage. SecurityTrackr action credits still apply at the same prices as managed AI. BYOK changes who supplies the model; it does not remove the action-credit charge.
Set spending controls on your provider account and check its quotas and model access. For SecurityTrackr charges and included credits, see billing and plans.
The five-minute walkthrough
In the app, the administrator opens Account → AI and clicks Set up your own AI provider. A short guided flow walks through the whole thing:
- 1Pick a provider. OpenAI, Anthropic, or Mistral.
- 2Create and paste a key. Generate a dedicated key in the provider's console, then paste it in. We encrypt it before it is stored (more on that below).
- 3Choose a model. Choose a capable model your account can access. See the model guidance below before accepting the suggested selection.
- 4Set a spend limit. We link you straight to your provider's billing settings so you can cap the monthly usage before any real traffic flows.
- 5Test it. We save the key, then run a quick test call to confirm the key, the billing, and the model all work. You get a validation result explaining whether the configuration works.
If the test fails, the key still gets saved, and we show you the validation result (for example, a wrong key, an unavailable model, or a spend limit already hit). Fix it and retry without starting over.
Choose a model suited to writing findings
Our managed service uses frontier models such as Claude Opus and GPT Sol for the text-writing parts of observation creation. We recommend choosing a comparably capable model for BYOK too, especially when findings need careful reasoning and clear prose.
Choose a model your account can access, then try a few representative findings and review the result. Compare factual accuracy, risk reasoning and useful recommendations alongside cost and response time. A successful connection test confirms access; it does not tell you whether the output suits your work.
How the key is stored, and how to keep it safe
On our side, the key is encrypted with AES-256-GCM under a key derived specifically for your organisation, before it is written to the database. It is never stored in plaintext, never logged, and never returned by the API. It is only decrypted in memory at the moment we make a request on your behalf.
On your side, treat it like any other production secret:
- Use a dedicated key for SecurityTrackr, so you can revoke it without breaking anything else.
- Set a monthly spend limit on the provider account before real traffic flows.
- Rotate or revoke the key if you stop using BYOK, or move away from SecurityTrackr.