What does BYOK mean?

How BYOK works

AI platforms usually access large language models via the platform operator's own accounts with providers. With BYOK, you instead store a key from your own provider account – for example for a cloud model service. Requests that use this key are then processed under your contract with the provider; usage and costs appear in your provider account.

Note: in cloud security, BYOK also refers to customer-managed encryption keys. In the AI context, as here, it usually means your own API keys for model providers.

Why companies use BYOK

• Existing contracts: many companies already have agreements, budgets or framework contracts with a cloud or AI provider and want to use them.
• Cost control: usage is visible directly in your own provider account and can be limited there.
• Contractual relationship: the data processing terms of your own provider contract apply to requests via your key.
• Model access: models or deployments that you have set up in your own account become usable in the platform.

What BYOK does not solve

• Data protection is not automatic: whether processing is lawful depends on the provider, the region and the contracts – see GDPR-compliant AI.
• The platform still processes data: prompts and answers continue to pass through the platform you use; its data processing agreement remains relevant.
• Limits still apply: rate limits and quotas of your provider account directly affect usage in the platform; once the budget is exhausted, requests via this key fail.
• Key management is your responsibility: keys must be rotated, restricted and revoked when employees leave or a key is compromised.

Checklist for BYOK

1. Create a dedicated key for the platform instead of reusing an existing one.
2. Limit the key's rights and budget at the provider as far as possible.
3. Check the region and data processing terms of the provider account.
4. Decide whether keys apply to the whole organisation or individual persons.
5. Define who may store, change and delete keys.
6. Plan regular rotation.

BYOK in AIPE

In AIPE, organisations and individual users can store their own provider API keys. Keys are stored encrypted. Usage via your own key is billed by your provider; usage via AIPE's model access is billed according to actual consumption, with public token prices. Model providers are configurable per organisation, and requests are routed via a model router. Which models are available is shown on the models page, prices on the pricing page. The guide GDPR and AI explains what to consider when choosing providers.