> ## Documentation Index > Fetch the complete documentation index at: https://docs.keenable.ai/llms.txt > Use this file to discover all available pages before exploring further. > ## Agent Instructions > Keenable search and fetch work without an API key. To add them to code, use the official SDK for the project's language: https://docs.keenable.ai/sdks.md > Read an API key from the KEENABLE_API_KEY environment variable. Never ask a user to paste a key into chat; send them to https://docs.keenable.ai/api-keys.md > On 402 with an API key (code insufficient_credits), stop and ask a human to add credits; don't retry. On the pay-per-request paths a 402 is the payment offer: pay it and retry, see https://docs.keenable.ai/pay-per-request.md. On 429, wait the number of seconds in Retry-After, then retry. > Every error, with its cause and fix: https://docs.keenable.ai/errors.md # Security and privacy > What Keenable logs for each search and fetch request, how API keys are handled, how zero data retention applies to an organization, and where to report a vulnerability: security@keenable.ai. Check what Keenable receives and logs when you send a request, before you route production traffic through it. The [Privacy Policy](https://keenable.ai/privacy) and the [Terms of Service](https://keenable.ai/terms) are the binding documents. This page says how they apply to API traffic and adds what you can observe as a caller. For a short statement of what Keenable keeps from your requests, see [Data and privacy](https://docs.keenable.ai/data-privacy.md). ## Request logs Keenable logs and stores every search and fetch request on the default data policy, whether or not you send an API key. Don't send secrets or personal data in a query, a URL or a prompt. The log for a request includes: * The search query, or the fetched URL, any fetch `prompt`, and the results. * Your IP address and your user agent. * The `X-Keenable-Title` value, if you send one. The keyless `/public` paths require it. * The request ID that the response returns in `X-Request-Id`. Support uses it to find your request (see [Get help](https://docs.keenable.ai/help.md#what-to-include)). * If you send an API key: your organization and the ID of the key. Keyless requests are logged the same way as keyed ones. See [Try it without a key](https://docs.keenable.ai/authentication.md#try-it-without-a-key). ## Retention and use Neither the Privacy Policy nor the Terms of Service sets a fixed retention period for request logs. | Data | Governing document | What the document says | | - | - | - | | Personal information, such as account details and IP addresses | [Privacy Policy](https://keenable.ai/privacy) | Keenable keeps it for as long as reasonably necessary to provide the service, meet legal obligations, maintain security and prevent abuse. Keenable processes it in the United States and in the countries where its service providers operate. | | Content you send as a business customer, such as queries, URLs and prompts | [Terms of Service](https://keenable.ai/terms), or your customer agreement if you have one | The terms set what Keenable may do with the content you send and with usage data, including use to improve and train its products. Read the sections on user content and usage data before you send sensitive queries. | SELECT also stores the output of each query as a result set that later queries can read. See [Result sets](https://docs.keenable.ai/select.md#result-sets). ## Zero data retention Zero data retention (ZDR) is a data retention policy that Keenable sets for an organization. It is part of the Enterprise offer, and the console has no switch for it. To ask for ZDR, open [Talk to us](https://app.keenable.ai/console/talk-to-us) in the console and choose **Zero data retention**, or use the [contact form](https://keenable.ai/contact). Confirm with Keenable what the policy covers for your traffic, and ask for it in your contract. As a caller in a ZDR organization, you see two things: * **The policy follows the API key.** Keenable takes the policy from the organization that owns the key. No header or parameter sets it. A request with no credential, such as a call to a `/public` path, isn't under your organization's policy. Send a key from the ZDR organization on every call. * **Some requests return `400`.** The API refuses a request that the policy doesn't allow, and retrying the same request returns the same `400`. | Request | `code` | Fix | | - | - | - | | A fetch with a `prompt` | [`zdr_prompt_unsupported`](https://docs.keenable.ai/errors#zdr-prompt-unsupported) | Remove the `prompt` parameter and fetch the whole page. | | A request that needs data sources the policy doesn't allow | [`zdr_unsupported_profile`](https://docs.keenable.ai/errors#zdr-unsupported-profile) | Email [support@keenable.ai](mailto:support@keenable.ai) with the request. | ## API keys * The console shows the full API key once, when you create it. Copy it then. Afterward the key list shows only the start of the key. * API keys belong to your organization and never expire on their own. * You can revoke an API key in the [console](https://app.keenable.ai/console/api-keys) at any time. If you send a revoked key, the API returns [`403`](https://docs.keenable.ai/errors#403). * Keep the key out of your code. The SDKs, the CLI and the MCP server read it from the `KEENABLE_API_KEY` environment variable. If a key leaks, create a new key, update `KEENABLE_API_KEY` everywhere it is set, then revoke the old key. See [Key lifetime and rotation](https://docs.keenable.ai/api-keys.md#key-lifetime-and-rotation). ## Encryption in transit Every Keenable address is an HTTPS URL: the API and the MCP server at `https://api.keenable.ai`, SELECT at `https://select.keenable.ai` and the console at `https://app.keenable.ai`. Call the `https://` URLs as documented, so your API key and queries are encrypted on the way to Keenable. ## Payment details Stripe processes card payments. Under the Privacy Policy, Keenable receives limited billing information, such as the billing name, the billing address and the last four digits of the card. Keenable doesn't store full card numbers. ## Report a vulnerability Email [security@keenable.ai](mailto:security@keenable.ai) with: * The affected URL, endpoint or service. * What the vulnerability is and its security impact. * Steps to reproduce it. A minimal proof of concept is enough. The [vulnerability disclosure policy](https://app.keenable.ai/security.md) covers services under `keenable.ai` and its subdomains. Under that policy, Keenable acknowledges a report within 3 business days and asks for coordinated disclosure, 30 days by default. Keenable runs no formal bug bounty program. The policy also lists what is out of scope and the safe harbor terms. For a problem that isn't a vulnerability, see [Get help](https://docs.keenable.ai/help.md). ## Legal documents and contacts | Topic | Where | | - | - | | Privacy Policy | [keenable.ai/privacy](https://keenable.ai/privacy) | | Terms of Service | [keenable.ai/terms](https://keenable.ai/terms) | | Privacy questions | [privacy@keenable.ai](mailto:privacy@keenable.ai) | | Security reports | [security@keenable.ai](mailto:security@keenable.ai), also listed in [security.txt](https://app.keenable.ai/.well-known/security.txt) | | Account, credits and the API | [support@keenable.ai](mailto:support@keenable.ai) | This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.