sureops supports two LLM key modes: Managed (sureops provides and operates the keys) and BYOK (you provide your own provider API keys). Both modes support the same agent functionality. The difference is in who owns the provider relationship and where the data flows.
Managed LLM
In managed mode, sureops provisions and operates the LLM provider accounts on your behalf.
How it works:
- sureops creates a per-customer account partition (an Anthropic Workspace or OpenAI Project) within sureops’s enterprise provider contract
- Your API keys are stored encrypted in sureops and rotated automatically
- LLM usage is metered and billed through sureops
- sureops selects the model for each agent from a curated map optimized for cost, quality, and latency
Advantages:
- No key management or rotation
- sureops handles provider outages and fallback routing
- Usage and spend visible in Settings → AI → LLM Configuration → Budget
- Available immediately after signup, no provider account required
Data flow:
Your prompts go to an LLM provider (Anthropic or OpenAI) via a provider account partition that sureops operates. sureops’s enterprise agreement with these providers includes zero data retention (ZDR) and no-training terms, covering all customer traffic routed through managed mode.
BYOK (Bring Your Own Key)
In BYOK mode, you provide your own API keys for your preferred LLM provider.
How it works:
- You generate an API key in your provider account
- You enter the key in Settings → AI → LLM Configuration → Add API key
- sureops stores the key encrypted and uses it for all LLM calls
- Usage is billed directly by your provider
Advantages:
- Data flows to your own provider account — your provider’s data processing terms govern the LLM side
- Full audit trail on your provider side (provider-side usage logs, cost breakdowns)
- Model choice: any model your provider supports can be selected per agent
- Predictable cost: you see the exact token usage in your provider’s billing dashboard
- Appropriate for organizations with strict requirements on which legal entities can process their data
Data flow:
To configure BYOK, go to Settings → AI → LLM Configuration → Add API key, enter your key, and select the provider. Then configure the default model at the org level or per agent.
PII redaction
Both managed and BYOK modes include automatic PII and secrets redaction before any context is sent to an LLM.
The redaction layer detects and replaces:
- Personal identifiable information (names, email addresses, IP addresses, phone numbers)
- Secrets and credentials (API keys, tokens, passwords matching common patterns)
- Other sensitive patterns
Redacted values are replaced with labeled placeholders (e.g., [REDACTED:EMAIL]) so the agent can still reason about the structure of the data without seeing the sensitive content.
PII redaction is applied in both modes and cannot be disabled. It is a non-configurable safety control, not an optional feature.
Comparison
Switching modes
You can switch between managed and BYOK at any time from Settings → AI → LLM Configuration.
Switching takes effect immediately. In-flight incidents continue with the previous mode until the next LLM call; after the switch, all new calls use the new mode.
Self-hosted deployments
Self-hosted deployments use BYOK only — managed mode is a SaaS-only feature. In self-hosted mode, LLM calls go from your infrastructure directly to your provider accounts. No data leaves your environment to sureops servers.
See Security & Compliance for more on the data flow in self-hosted deployments. 