Bring Your Own Key — Use your existing API contracts with SignalGuard

The economics of premium event-security data are brutal. A single AccuWeather Enterprise contract with MinuteCast and Lightning Imminent Strikes lands around $25/mo on Standard and climbs from there. A Dataminr Pulse seat is $25K–100K+ a year. Recorded Future is $50K–150K. Flashpoint, Mandiant, Placer.ai, Veraset — every one of them sits in the same neighborhood. If SignalGuard tried to bake those contracts into every customer's subscription, PAYG could not exist at $19 and Pro could not exist at $249/mo. The bill would be the bill, regardless of whether a customer wanted the fidelity those feeds buy.

The alternative — capping every signal at whatever the free upstream tier supports — punishes the operators who actually need event-security threat intel the most. A festival production company already paying AccuWeather for minute-level precip forecasts should not get the same weather fidelity as a hobbyist running their first scan. A protective intelligence team that already runs Flashpoint and Dataminr should not see their dark-web and breaking-event coverage downgraded just because SignalGuard happens to mediate the request.

BYOK splits the difference honestly. SignalGuard ships working coverage on all 50+ signals at every tier using shared upstream quotas — enough for evaluation, enough for occasional scans, enough that the platform is useful out of the box. When a customer already pays for a premium feed, they paste their key into /integrations, and that signal's resolver switches over to the customer's contract on the next scan. Same brief, same scoring, higher-fidelity input. The contract stays where it already is — finance and procurement do not have to learn a new vendor.

The result is unit economics that work for everyone. Customers do not pay twice for data they already license. SignalGuard does not have to wrap premium contracts into the SaaS price. And the operators who care about fidelity — the ones whose event day depends on Lightning Imminent Strikes, on Dataminr's earliest-warning detection, on Recorded Future's threat coverage — get the data they already paid for, fused into the same brief as everything else.

Open /integrations in your workspace. Each supported provider has a tile with the fields it needs — usually one API key, sometimes a client ID and secret pair. Paste the credential, hit validate.

The validator runs server-side, never in the browser. For most providers it makes a single cheap probe against the upstream API — an AccuWeather geoposition lookup, a Ticketmaster events search with limit=1, a Tomorrow.io realtime call. The request uses your key, so the response tells us in one round-trip whether the key is real, scoped correctly, and not expired. Soft validators (for providers with no public test endpoint — Flashpoint, Recorded Future, Veraset, etc.) check shape and length, then surface real auth errors on the first signal-time use.

Once validated, the credential is encrypted with AES-256-GCM and stored against your workspace ID, bound as additional authenticated data so a key cannot be replayed across workspaces even if our database were dumped. The plaintext never lands on disk. At scan time, the signal resolver decrypts the key, swaps it into the upstream request, and throws the plaintext away as soon as the call completes. The key never leaves the resolver process, is never logged, never appears in error traces.

Deleting the credential purges the ciphertext from the database. The next scan falls back to SignalGuard's shared upstream for that signal. No state lingers.

AES-256-GCM at rest. Every BYOK credential is encrypted with a workspace-scoped key derived from a master key held in our KMS. The IV is regenerated on every write — no IV reuse, no nonce collisions. The cipher's authentication tag is verified on decrypt, so a tampered ciphertext fails closed.

AAD binding. Additional authenticated data binds each ciphertext to the workspace ID and provider ID. A row exfiltrated from the database cannot be decrypted into the wrong workspace's session, even by someone with the master key, because the AAD does not match.

Never logged. Request loggers, error handlers, and tracing middleware redact known credential fields. Plaintext keys live only inside the signal resolver function for the duration of the upstream call, then go out of scope. The encrypted form never appears in stdout, never in error reports, never in third-party APM.

DELETE purges. Removing a credential from /integrations deletes the ciphertext row outright. No tombstone, no soft delete, no "we kept a copy in case." The next scan falls back to shared upstream.

Workspace-isolated. BYOK credentials never cross workspace boundaries. A Team workspace's AccuWeather key is invisible to an Enterprise workspace under the same parent org unless the credential is explicitly added to that workspace. There is no global pool.