How Shoulder Surf protects your API keys
When you bring your own key, your credentials stay on your device and go directly to the AI provider.
Stored in iOS Keychain
Your API keys are saved in Apple's iOS Keychain, the same hardware-backed encrypted storage that iOS uses for your passwords, credit cards, and Face ID credentials. Keys are encrypted at rest using your device passcode and biometrics. They are never written to plain text, UserDefaults, or any other unprotected storage.
Direct device-to-provider
When you ask a question, your API key travels directly from your iPhone to the AI provider (OpenAI, Anthropic, Google, etc.) over an encrypted HTTPS connection. The request never passes through Shoulder Surf servers. We never see, proxy, or log your key.
Never touches our servers
Shoulder Surf has no server-side component that receives BYOK credentials. Your key exists only on your device and in the HTTPS request to your chosen provider. There is no cloud backup, no analytics capture, and no telemetry that includes your key.
Device-local only
API keys are not synced to iCloud, CloudKit, or any other cloud service. If you switch devices, you'll enter your key again, by design. This ensures your credentials can't be exposed through a cloud account compromise.
Never logged or cached
API keys are read from the Keychain, used for a single request, and discarded from memory. They are never written to app logs, crash reports, or on-disk caches. Request logs redact all sensitive headers and base64 image data automatically.
Format validation
The app detects when you accidentally paste a key for the wrong provider (e.g., an Anthropic key in the OpenAI field) and warns you before you make a request. This prevents accidental exposure of a key to the wrong third party.
How a BYOK request works
Every query follows the same secure path. Your key never leaves your device except inside the encrypted request to the provider you chose.
Shoulder Surf captures your transcript, photo, or prompt on-device.
Your API key is retrieved from iOS Keychain into memory for this request only.
The request goes directly to the AI provider over TLS. No Shoulder Surf servers involved.
The provider's response is shown on-screen. Your key is released from memory.
Common questions
Can Shoulder Surf read my API key?
The app reads your key from the Keychain to make the API call, and that's the only time it's in memory. It is never transmitted to us, logged, or stored anywhere other than the Keychain.
What if I lose my phone?
iOS Keychain data is encrypted with your device passcode. If your device is locked, the key is inaccessible. You can also revoke the key from your AI provider's dashboard at any time.
Do I need an account to use BYOK?
No. BYOK requires no Shoulder Surf account, no sign-in, and no subscription. Just paste your key in Settings and go.
What data is sent to the AI provider?
The transcript excerpt, your question, and any attached photos (compressed). Your API key is included in the request header. No other personal data is sent. See our Privacy Policy for full details.
Is this safer than using Shoulder Surf's cloud service?
Both paths are secure. With BYOK, data goes directly to the provider you choose, with no intermediary. With Shoulder Surf AI (our managed service), data is processed through our cloud with Sign in with Apple authentication and JWT tokens stored in the Keychain. Choose whichever model fits your trust preferences.
Ready to bring your own key?
Open Shoulder Surf, go to Settings, and paste your API key.
That's it.
