Where your secrets live, and where they don't
An API key is trust in the form of text. Here's exactly where your secrets go in Botster and, more importantly, where they never go.
The AI plans and never sees your keys
When you describe an automation, the AI works out the shape: the steps, the order, the connections. It doesn't need your credentials to do that, and it doesn't get them. Keys and tokens never reach the model or the plan it produces.
Secrets don't live in the automation
A saved secret is encrypted at rest and stays on our side. It isn't written into the automation or into any file you could export. When a run genuinely needs a key, we inject it at execution time, and only for as long as the run takes.
- Encrypted at rest, write-only from the interface.
- Injected into a single run, then gone.
- Never shown again after you save it, not even to you.
A secret only leaves the vault to perform a single run, and never lives inside the automation itself.
Isolation by design
Your automations, runs and connections belong to your workspace and no one else's. Separation between customers is enforced on our side, not left to a configuration switch you have to remember to turn on.
An automation is only as trustworthy as its handling of secrets. That's why we keep yours with you by default: planning kept apart from credentials, and credentials kept apart from everyone else.
Ready to describe your first automation?
Leave your email and tell us in two sentences what you'd like to automate. We'll reach out with an invitation.
Request early access