Two LLM key modes exist in the product today: BYOK (you provide your own provider API keys) and demo/trial (sureops supplies LLM capacity for a demo or trial environment). A third mode — sureops-managed Anthropic/OpenAI — has been designed but is not launched. This page describes what’s actually live today and is explicit about what’s still ahead.
BYOK (Bring Your Own Key)
In BYOK mode, you provide your own API keys for your preferred LLM provider. This is the default and the only mode available for a production organization today.
How it works:
- You generate an API key in your provider account
- You enter the key in Settings → AI Agents, in the LLM Provider API Keys card
- sureops stores the key encrypted and uses it for all LLM calls
- Usage is billed directly by your provider
Advantages:
- Data flows to your own provider account directly — your provider’s data processing terms govern the LLM side, with no sureops-operated intermediary for chat/inference calls (one universal exception: embeddings generation for semantic search always runs through a sureops-owned OpenAI credential, in every mode including BYOK — see Security & Compliance)
- Full audit trail on your provider side (provider-side usage logs, cost breakdowns)
- Model choice: pick from sureops’s curated, validated model set for your provider
- Predictable cost: you see the exact token usage in your provider’s billing dashboard
- Appropriate for organizations with strict requirements on which legal entities can process their data
Data flow:
To configure BYOK, go to Settings → AI Agents, find the LLM Provider API Keys card, and click Add Key (or Update if a key is already set), then select the provider. Configure the default model at the org level or per environment in the AI Defaults card in the same section — in practice you’ll almost always be looking at the Environment AI Defaults version of that card, since the AI Agents tab itself requires an environment to be selected first.
Your org’s spend ceiling is visible at Settings → Budget (and the per-environment Budget tab).
Demo/trial mode
Demo and trial environments run on LLM capacity sureops supplies, so you can evaluate the product without bringing your own provider key. Under the hood, that traffic is served through inference-hosting providers running open-weight models, under data-processing terms that restrict retention and prohibit training on your content — not through sureops-operated Anthropic or OpenAI accounts. Demo/trial LLM processing has no regional-residency option today; if your organization has data-residency constraints, use BYOK once you move to a real environment.
Managed mode — designed, not yet launched
There is no live sureops-managed Anthropic/OpenAI mode today. sureops has designed — but not shipped — a paid “managed” mode in which sureops would supply LLM capacity from Anthropic and OpenAI under sureops enterprise agreements, so you could get started without connecting a provider key. Those agreements are not signed and the mode is not available for signup. Concretely, today:
- No customer content flows to Anthropic through a sureops-owned account.
- No prompts or completions flow to OpenAI through a sureops-owned account (aside from a narrow embeddings function used for semantic search, which is unrelated to managed-mode chat/inference and applies in every mode, including BYOK — see Security & Compliance for details).
- Anthropic is not currently a sureops sub-processor.
If and when managed mode launches, the plan is: sureops would provision and operate a per-customer account partition (an Anthropic Workspace or OpenAI Project) inside sureops’s own provider accounts, meter and bill usage through sureops, and select the model for each agent from a curated map. It would only route real customer traffic once the required enterprise data-processing and retention terms with Anthropic and OpenAI are signed. We’ll update this page and our sub-processor list before any of that traffic starts. Contact hello@sureops.ai if you want to be notified when it ships.
PII redaction
Redaction coverage today is scoped to chat surfaces, not the incident pipeline.
- ECHO and SAGE chat (and public chat): tool output flowing back into the conversation is scrubbed before it re-enters agent context, catching secret/token patterns (API keys, tokens, connection strings, and similar) at that seam. Detected values are replaced with an opaque placeholder token (e.g.,
[redacted] for secrets, [email-redacted] for emails, [ip-redacted] for IPv4 addresses) — the match is simply blanked out, with no attempt to preserve the structure of the underlying data. The detector set covers connection strings, password-in-URL, private keys, Supabase keys, provider API keys, bearer tokens, AWS keys, JWTs, internal UUIDs, email addresses, and IPv4 addresses.
- Incident-pipeline agents (Diagnosis, Resolution, Verification, Incident Commander, Problem Commander): in BYOK mode, these agents get no redaction layer at all today. Whatever telemetry, logs, or tool output the agent pulls in goes to your provider as-is. Your own provider relationship and its data-handling terms are the only control here — if that matters for your compliance posture, factor it into which provider and terms you choose for BYOK.
The tool-output scrub described above applies only to ECHO/SAGE/public chat surfaces. It is not a general-purpose redaction layer, and it does not run on the incident-response pipeline agents in BYOK mode.
Switching modes
There’s no customer-facing org-level switch that toggles your organization between managed and BYOK on demand — and since managed mode isn’t launched, every organization today is on BYOK (or demo/trial). The one piece of this that does exist and ships today is narrower, at the environment level, in anticipation of managed mode: a future managed organization would be able to override a specific environment down to BYOK (for example, to route a sensitive environment through your own provider account while the rest of the org stays managed). That override is API-only today (settings:write capability) — there’s no dashboard toggle for it. It can be cleared via the same API (a PATCH with a null override), which makes the environment re-inherit the org default — it just can’t be toggled back to managed through any dashboard UI.
Contact hello@sureops.ai if you have questions about your organization’s mode or want help with the API-based override.
Self-hosted deployments
Self-hosted deployments use BYOK only — managed mode, once it exists, will be a SaaS-only feature. In self-hosted mode, LLM calls go from your infrastructure directly to your provider accounts. No data leaves your environment to sureops servers.
See Security & Compliance for more on the data flow in self-hosted deployments. 