> ## Documentation Index
> Fetch the complete documentation index at: https://docs.dreamlayer.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Security, privacy, and telemetry

> Keep API keys, private media, and signed download links out of logs and monitoring.

# Security, privacy, and telemetry

## Never collect by default

DreamLayer does not send prompts, uploaded or generated images, local file paths, workflow JSON, provider keys, DreamLayer keys, authorization headers, private routing plans, model-selection reasoning, or forbidden provider and internal-cost metadata to monitoring.

## Allowed operational telemetry

* Environment and release identifier
* Sanitized endpoint and error category
* Public job and restricted correlation IDs
* Duration, status, retry, and recovery state
* Credit reserved, settled, or restored state without payment secrets

## API keys and downloads

Keep API keys in server-side environment variables or a secret store, not browser storage or public source. Authenticate owned downloads at the API origin only. Fetch a redirected storage URL without the API Authorization header, and never share its signed query string in logs.

## Managed boundary

Log only the fields your integration needs, such as execution ID, status, and credit settlement state. Do not log full request or response bodies. Video records can contain the source prompt and settings. The public Video reference documents an integration-focused subset, not a guarantee that a response contains no other fields.

Report suspected cross-account access, double charge, data loss, secret exposure, or private-routing leakage immediately and stop affected execution.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.