> ## Documentation Index
> Fetch the complete documentation index at: https://docs.sureops.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# BYOK vs Managed LLM

> Choose between sureops-managed LLM keys and bringing your own provider API keys.

sureops supports two LLM key modes: **Managed** (sureops provides and operates the keys) and **BYOK** (you provide your own provider API keys). Both modes support the same agent functionality. The difference is in who owns the provider relationship and where the data flows.

## Managed LLM

In managed mode, sureops provisions and operates the LLM provider accounts on your behalf.

**How it works:**

* sureops creates a per-customer account partition (an Anthropic Workspace or OpenAI Project) within sureops's enterprise provider contract
* Your API keys are stored encrypted in sureops and rotated automatically
* LLM usage is metered and billed through sureops
* sureops selects the model for each agent from a curated map optimized for cost, quality, and latency

**Advantages:**

* No key management or rotation
* sureops handles provider outages and fallback routing
* Usage and spend visible in **Settings → AI → LLM Configuration → Budget**
* Available immediately after signup, no provider account required

**Data flow:**

```
sureops backend → sureops-operated provider partition → LLM → response
```

Your prompts go to an LLM provider (Anthropic or OpenAI) via a provider account partition that sureops operates. sureops's enterprise agreement with these providers includes zero data retention (ZDR) and no-training terms, covering all customer traffic routed through managed mode.

***

## BYOK (Bring Your Own Key)

In BYOK mode, you provide your own API keys for your preferred LLM provider.

**How it works:**

* You generate an API key in your provider account
* You enter the key in **Settings → AI → LLM Configuration → Add API key**
* sureops stores the key encrypted and uses it for all LLM calls
* Usage is billed directly by your provider

**Advantages:**

* Data flows to your own provider account — your provider's data processing terms govern the LLM side
* Full audit trail on your provider side (provider-side usage logs, cost breakdowns)
* Model choice: any model your provider supports can be selected per agent
* Predictable cost: you see the exact token usage in your provider's billing dashboard
* Appropriate for organizations with strict requirements on which legal entities can process their data

**Data flow:**

```
sureops backend → your provider account → LLM → response
```

To configure BYOK, go to **Settings → AI → LLM Configuration → Add API key**, enter your key, and select the provider. Then configure the default model at the org level or per agent.

***

## PII redaction

Both managed and BYOK modes include automatic PII and secrets redaction before any context is sent to an LLM.

The redaction layer detects and replaces:

* Personal identifiable information (names, email addresses, IP addresses, phone numbers)
* Secrets and credentials (API keys, tokens, passwords matching common patterns)
* Other sensitive patterns

Redacted values are replaced with labeled placeholders (e.g., `[REDACTED:EMAIL]`) so the agent can still reason about the structure of the data without seeing the sensitive content.

<Warning>
  PII redaction is applied in both modes and cannot be disabled. It is a non-configurable safety control, not an optional feature.
</Warning>

***

## Comparison

|                      | Managed                              | BYOK                                  |
| -------------------- | ------------------------------------ | ------------------------------------- |
| **Key management**   | sureops manages                      | You manage                            |
| **Provider account** | sureops-operated partition           | Your account                          |
| **Billing**          | Through sureops                      | Directly from provider                |
| **Model choice**     | sureops-curated set                  | Any model your provider supports      |
| **Data governance**  | sureops DPA + provider ZDR agreement | Your provider's terms                 |
| **Spend visibility** | Settings → Budget                    | Provider billing dashboard            |
| **PII redaction**    | Yes                                  | Yes                                   |
| **Setup time**       | Immediate                            | 5–10 minutes (key generation + entry) |

***

## Switching modes

You can switch between managed and BYOK at any time from **Settings → AI → LLM Configuration**.

Switching takes effect immediately. In-flight incidents continue with the previous mode until the next LLM call; after the switch, all new calls use the new mode.

***

## Self-hosted deployments

Self-hosted deployments use BYOK only — managed mode is a SaaS-only feature. In self-hosted mode, LLM calls go from your infrastructure directly to your provider accounts. No data leaves your environment to sureops servers.

See [Security & Compliance](/next/operating-modes/security-and-compliance) for more on the data flow in self-hosted deployments.