Mivia uses a Bring Your Own Keys (BYOK) model. The platform does not resell model access or host tokens. You configure provider credentials in your organization settings, and the platform uses them only for runs you explicitly start.

## Storage

Keys are encrypted using AES-256-GCM before writing to the database. Plaintext keys are never written to logs, database rows, or API responses.

```mermaid
flowchart LR
    A[Admin submits key] --> B[Encrypt AES-256-GCM]
    B --> C[(Encrypted store)]
    C --> D[Decrypt at call time]
    D --> E[Provider call]
    E --> F[Scoped response]
```

## Scoping

Organization admins configure which credentials are active. A configured key can only be used by agents belonging to that organization.

## Rotation

Rotate credentials by saving a new key in settings and removing the old one.

## What is never stored

- Provider console passwords or master OAuth credentials
- Credit card or billing payment data
- Ephemeral test secrets