Not legal advice. The notes on data processing and the GDPR are an overview. For individual constellations, involve a data protection officer or a lawyer.
What does BYOK mean?
BYOK stands for Bring Your Own Key. Instead of using the platform's bundled AI credits, you can store your own API keys for the major AI providers (OpenAI, Anthropic, Google). All AI tools on the platform (exposé generator, smart floorplan, AI assistant) then run through your own provider account. The costs appear directly on the provider's bill, not in the platform credits.
When is BYOK worthwhile?
High volume: if your office produces very many AI calls per month (high-volume tools such as batch exposé generation or automated lead qualification), the providers' direct rates can be cheaper than bundled credits. Rule of thumb: from about 200 EUR of provider costs per month, it is worth checking.
Existing enterprise contracts: some offices already have contracts with OpenAI or Anthropic (for example OpenAI Business or Anthropic for Work) with customized data protection terms, their own data processing agreement and guaranteed data locality. In that case BYOK is the simplest way to use those contracts inside the platform as well.
Compliance requirements from your clients: if your principals dictate which cloud providers may (or explicitly may not) be used, BYOK lets you steer the provider choice per tool and workspace directly.
Data sovereignty: for sensitive content (e.g. private client information, valuation reports), your own provider account gives additional control and transparency over the actual data flow.
When does BYOK not make sense?
- Low volume: bundled credits are usually cheaper thanks to volume discounts.
- Low IT affinity: provider accounts, billing limits and key rotation mean extra administrative work.
- Compact plan: BYOK is not available. Available from the Standard plan upwards.
Supported providers
| Provider | Models | Status |
|---|---|---|
| OpenAI | GPT-4, GPT-4 Turbo, GPT-4o | Available |
| Anthropic | Claude Sonnet, Claude Opus, Claude Haiku | Available |
| Gemini Pro, Gemini Flash | Available | |
| Replicate | Image models (for visualization tools) | Available |
Additional providers are evaluated on request.
Step by step: store a key
- Go to Settings > AI providers.
- Choose the provider from the list (e.g. OpenAI).
- Click Add your own key.
- Enter the API key. Give it a name for clarity, such as "OpenAI office main account".
- Optional: set a monthly spending limit (e.g. 500 EUR). When it is exceeded, the platform automatically falls back to the platform pool and notifies you.
- Click Send test request. The platform sends a minimal probe call and reports the result.
- Activate the key with the Use as active key switch.
From that moment on, all AI calls for this provider run through your key, not through the platform pool.
What the platform does with the key
- Tools call the provider directly with your key. The platform passes the request through technically without caching the AI response itself (unless you explicitly enable caching).
- Cost tracking appears in your provider dashboard, not in the platform credit account. Platform credits are not deducted for these calls.
- In the platform you can still see under Settings > AI providers > Usage how many requests were made per tool and user, without the EUR amounts the provider bills you directly.
Security
- Keys are stored encrypted at rest in the database (AES-256, separate encryption key management).
- Decryption happens only at the moment of the API call in the backend. The plain-text key never leaves the backend and is never visible in the frontend.
- After the first save the key is masked in the interface (only the last four characters remain visible).
- Only users with the Admin role can view, change or delete keys.
Audit and traceability
Every API call that runs through a BYOK key is recorded in the audit log:
- Timestamp
- User (which account executed the tool)
- Tool / module
- Provider and model
- Token consumption (input and output)
- HTTP status / error code
The activity log is available under Settings > Aktivität (activity).
Rotation and emergency revocation
We recommend rotating keys at least every 90 days:
- Generate a new key at the provider.
- In the platform, click Replace key on the existing entry and paste the new value.
- Run a test request.
- Revoke the old key in the provider dashboard.
If you suspect a leak (the key accidentally became public, e.g. in a screenshot): revoke it immediately in the provider dashboard, then replace it in the platform with a new one. During the short transition the platform automatically falls back to the platform pool, so tools do not fail.
GDPR and processing on behalf
The most important point: with BYOK, the responsibility for the data processing relationship with the AI provider shifts. Instead of the platform, your office directly concludes the data processing agreement (DPA) with OpenAI, Anthropic or Google.
Concretely this means:
- You as the tenant must ensure that a valid DPA under Art. 28 GDPR exists with the provider. The providers offer contract templates for this.
- You must document the processing in your record of processing activities.
- You must correctly inform your end clients about the data processing (e.g. in your website's privacy policy).
- For data subject requests (access, deletion) you are the primary contact. The platform supports you with logs and export functions.
As long as you use the platform pool, the platform takes care of these duties. As soon as you switch to BYOK, the responsibility shifts to you. Plan enough preparation time and align with your data protection officer.
Switching between BYOK and the platform pool
You can switch at any time. You can also decide per provider: run OpenAI through BYOK, for example, while Anthropic and Google stay on the platform pool. Active tool runs are not interrupted; the switch takes effect from the next call.