vaaya / about

Security, data, and trust

Vaaya is the access and payment infrastructure for AI agents: one connection that gives an agent metered, pay-per-call access to the providers it needs. The core security fact is simple. Your agent never receives an upstream provider credential. This page explains who builds Vaaya, what data moves where, and which controls bound what an agent can spend.

What Vaaya does

An agent describes an outcome. Vaaya routes it to a suitable provider, validates the request, shows the price ceiling, executes the call, and returns the result. Search, data, LLMs, media, scraping, compute, and storage all sit behind the same connection. The gateway architecture is described in the white paper.

Calls are metered individually and failed calls are not billed. See the public capability catalog, pricing, and documentation.

Who builds it

Vaaya is built and maintained by Vaaya Inc. The MCP connector and integration work are visible through the vaaya-ai GitHub organization, where developers can inspect releases, open issues, and follow the project.

Our goal is simple: make a new capability available to an agent without making every user become an API integrator and billing administrator.

The controls, by name

The agent gets narrow, metered access to a capability, never the credential behind it. Each claim below names the control rather than an adjective.

  • Credentials. Provider keys and accounts are held server-side by Vaaya and injected only when a validated call is dispatched. Your agent, and you, never see them.
  • Authorization. MCP clients connect over OAuth 2.1 with PKCE; API callers use a bearer key you can name and revoke at /api-keys. Revoking a grant never requires rotating an upstream key.
  • Spend. Every paid call carries a maximum cost, is priced before it runs, is charged only after a successful result, and lands in your ledger with its price and outcome. Outbound work such as email drafts waits for your approval.
  • Payment rails. Vaaya settles through x402, MPP, or a conventional provider account while you see one balance and one audit trail. Agents holding USDC can also pay supported endpoints directly over x402, with no Vaaya account.
  • Transport. Traffic is encrypted in transit, and stored data is encrypted at rest (see the Privacy Policy).
  • Incidents. Security reports go to hello@vaaya.ai and are read by the people who operate the system.

What data moves where

A call cannot run without sending its parameters to the provider that serves it. Here is what Vaaya stores and forwards, per data type. Across every row: your data is never used to train public or shared foundation models, never sold, and never licensed to third parties (Privacy Policy).

DataStored by VaayaSent to providersRetentionYour control
Call parameters & resultsYes, in your transaction history, so results can be replayed instead of re-billedParameters go to the one provider serving the callKept with the accountVisible in your history; deleted with your account
Consult conversationsYes, so routing improves and you can review what was askedNo, routing happens inside VaayaKept with the accountVisible in your history; deleted with your account
Billing metadata (price, provider, outcome)Yes, this is the ledgerNoKept for accounting and tax obligationsExportable from your history
Files you uploadYes, in your file library, billed onceOnly when a call you make uses themUntil you delete themDelete any time
Company memory (brain)Yes, scoped to your workspaceNoUntil you clear itEdit or clear from the app
GitHub profile dataThe computed score and its inputs, public data onlyNoRefreshed at most daily; kept while connectedDisconnect any time; the read:user grant is revocable at GitHub
Provider credentialsHeld server-side, encryptedInjected per validated call, never returned in a responseRotated by VaayaNot applicable, they are Vaaya's accounts

Questions, security reports, or partnerships

Email hello@vaaya.ai, or open an issue in the public MCP repository. Legal and privacy contacts are listed in our Privacy Policy and Terms.