AsaleHow we keep you safe
What is signed, what is never stored, and the one thing we cannot protect you from — stated plainly.
The honest limit first
Your request is relayed by another user's client, which reconstructs and sends it upstream. At that moment the text is visible to that machine.
Do not send confidential material through the market. If a request must not be seen by anyone else, run it against your own subscription with that tool's Buy switch off.
Everything below is true. That sentence is also true, and no amount of the rest changes it.
What is never stored
The platform matches, relays and bills. It does not keep what it relays.
- No message column in the database.
- Traffic is relayed in memory and dropped.
- No cache layer holding request bodies.
- No request or response bodies in logs.
The platform does parse your request — it has to translate between Anthropic, OpenAI and Gemini dialects — but it counts tokens rather than reading meaning, and keeps nothing.
Sellers cannot be tricked into spending their quota
Every dispatch is signed by the gateway with an Ed25519 key over task_id | model | budget | expiry. The seller's client verifies that signature before touching its own subscription. A forged or replayed dispatch spends nothing.
Signatures expire after an hour, and the budget in them is the ceiling the seller enforces locally: a stream that runs past it is cut off.
Sellers cannot cheat buyers
- Output above the signed budget is not billable.
- Prompt counts above the gateway's own estimate are clamped and scaled.
- A task channel is bound to the device it was dispatched to, so no other seller can inject into it or report usage for it.
- Both sides of the count are cross-checked, and deviation is recorded against reputation.
Buyers cannot cheat sellers
- Cost is frozen before dispatch. A buyer with no balance never reaches a seller.
- Charges are capped at what the wallet actually holds; balances cannot go negative.
- Per-account rate limits apply on both sides.
Identity
| Credential | Where it lives |
|---|---|
| Your buyer API key | Your machine. The server keeps only a SHA-256 hash. |
| A seller's upstream token | That seller's machine, encrypted. Never sent to the platform or the buyer. |
| A device's signing key | That device. Only the public key is registered. |
| The platform's signing key | The server. Only the public key is distributed. |
Device sessions authenticate with a signed, time-boxed, single-use handshake — a replayed one is rejected, and issuing a new device token invalidates the old one immediately.
Money
Every movement is double-entry. Every hour the books are re-checked in full: total debits against total credits, and each account's ledger against its stated balance. A mismatch freezes the wallet and raises an alert rather than being absorbed.
The client is open source
The client is the component that holds your credentials and sends your requests. Its source is public so that claim can be checked rather than believed.