What BYOK means here
Bring-your-own-key (BYOK) on ToRun lets you add your own provider API key on the BYOK page in your account. Calls that can use it go through your own provider account: the provider bills that account for model usage, and ToRun charges a reduced platform fee.
Encryption at rest
Your key is stored encrypted. It is decrypted only when ToRun calls your provider with it.
A record of every use
Each time your key is picked for a call, ToRun records it, and every call still writes a billing record, so your usage history stays complete. The Acceptable Use Policy and content moderation apply to BYOK calls too.
What this is not
This is not a replacement for your own secret manager. If you operate on a regulated workload, mirror your credentials into your own KMS too. ToRun's vault is a runtime injection layer, not a primary secret store.