Data & privacy
Privacy Policy
PromptSlayer is an independent AI security research project. This page explains how it handles data during live audits.
No advertising or behavioral tracking
PromptSlayer does not intentionally run advertising, behavioral tracking, or user-profile analytics.
Browser storage
Your browser's localStorage keeps consent choices, audit settings and preferences, local audit references and history, and view tokens for audits started from that browser. API keys, custom headers, and system prompts are excluded from localStorage.
Live audit data flow
When you start a live audit, your browser sends data to the PromptSlayer backend, which contacts the target, model provider, or evaluator you configure. Audit data may include the target endpoint, provider and model details, system and adversarial prompts, target and evaluation responses, custom headers, audit settings, and results.
API keys and credentials
Live audits use API keys you provide. These keys go to the PromptSlayer backend and may be sent to your selected target, provider, or evaluator for authentication. The backend removes API key and evaluation API key fields before saving audit configuration. Avoid putting secrets in prompts or other fields not meant for credentials.
Audit result retention
The backend stores audit results in SQLite. On startup, it deletes audits older than 30 days. The backend runs on ephemeral infrastructure, so records may disappear sooner after a restart, redeploy, or other infrastructure change.
Providers and hosting
The public site at promptslayer.online is hosted by Vercel; the backend at api.promptslayer.online is hosted by Render. These hosts may process IP addresses, request logs, diagnostics, and other operational data under their own policies. AI and model providers you configure process data sent to them under their own terms and privacy policies.
Data selling and sharing
PromptSlayer does not sell user data or intentionally share audit data with advertising networks or data brokers. Live audit data is sent to the target, provider, or evaluator you choose as needed for the audit.
Your control
You can clear locally stored consent choices, settings, audit history, and view tokens through your browser settings. Clearing browser storage does not delete results already stored by the backend.
Summary
Live audits send data from your browser through PromptSlayer's backend to the targets and providers you configure. The backend stores audit results temporarily, while your browser keeps local settings and audit references. Hosting providers may also process ordinary request and operational data.