Keys entered in the Integrations Hub are stored in your WordPress database and are only shown on that screen.

For extra safety, define keys in wp-config.php instead. A constant always overrides the stored value, and the key then never appears in the database or the admin screens.

The constant name is KRITI_AI_KEY_ followed by the provider's name in capitals. Each card in the Integrations Hub shows its exact constant name.

define( 'KRITI_AI_KEY_OPENAI', 'sk-...' );
define( 'KRITI_AI_KEY_ANTHROPIC', '...' );
define( 'KRITI_AI_KEY_GEMINI', '...' );
define( 'KRITI_AI_KEY_OPENAI_IMAGE', 'sk-...' );   // OpenAI image card
define( 'KRITI_AI_KEY_ELEVENLABS', '...' );

Add these above the line /* That's all, stop editing! */.

Only users with the manage_options capability (administrators) can use Kriti AI, and every action is protected by a WordPress security token (nonce).

• When you generate, your prompt and the generation settings are sent to the provider you selected, and the result comes back to your site. Nothing is sent to Kriti AI.
• With Ollama or Local AI, requests go only to the server URL you entered.
• Test connection only reads from the provider, for example its model list.

Review your provider's terms and privacy policy before sending confidential or personal information, and mention the providers you use in your site's privacy policy.