vaaya / about

Security, data, and trust

Vaaya connects AI agents to paid services and handles the provider accounts, credentials, and billing. Provider keys stay with Vaaya. Learn who builds the product, how requests are handled, and how you can control spending.

What Vaaya does

An agent describes an outcome. Vaaya routes it to a suitable provider, validates the request, shows the price ceiling, executes the call, and returns the result. Search, data, LLMs, media, scraping, compute, and storage all sit behind the same connection. The gateway architecture is described in the white paper.

Calls are metered individually and failed calls are not billed. See the public capability catalog, pricing, and documentation.

Who builds it

Vaaya is built and maintained by Vaaya Inc. The MCP connector and integration work are visible through the vaaya-ai GitHub organization, where developers can inspect releases, open issues, and follow the project.

We want adding a service to an agent to be as simple as asking it to do the work.

How access and spending are controlled

Your agent uses a Vaaya connection to call services. You can limit its spending and revoke its access without changing provider credentials.

  • Credentials. Provider keys and accounts are held server-side by Vaaya and injected only when a validated call is dispatched. Your agent, and you, never see them.
  • Authorization. MCP clients connect over OAuth 2.1 with PKCE; API callers use a bearer key you can name and revoke at /api-keys. Revoking a grant never requires rotating an upstream key.
  • Spend. Every paid call carries a maximum cost, is priced before it runs, is charged only after a successful result, and lands in your ledger with its price and outcome. Outbound work such as email drafts waits for your approval.
  • Payment rails. Vaaya settles through x402, MPP, or a conventional provider account while you see one balance and one audit trail. Agents holding USDC can also pay supported endpoints directly over x402, with no Vaaya account.
  • Transport. Traffic is encrypted in transit, and stored data is encrypted at rest (see the Privacy Policy).
  • Incidents. Security reports go to hello@vaaya.ai and are read by the people who operate the system.

What data moves where

A call cannot run without sending its parameters to the provider that serves it. Here is what Vaaya stores and forwards, per data type. Across every row: your data is never used to train public or shared foundation models, never sold, and never licensed to third parties (Privacy Policy).

DataStored by VaayaSent to providersRetentionYour control
Call parameters & resultsYes, in your transaction history, so results can be replayed instead of re-billedParameters go to the one provider serving the callKept with the accountVisible in your history; deleted with your account
Consult conversationsYes, so routing improves and you can review what was askedNo, routing happens inside VaayaKept with the accountVisible in your history; deleted with your account
LLM router requestsNo. Per-call metadata only: model, tokens, price, calling client, a hash of the system prompt, a scrubbed 200-character prefix of the first messageThe full request goes to the one model provider serving itMetadata kept with the account. Full bodies are captured only for accounts flagged for abuse, and deleted after 7 daysDeleted with your account
Billing metadata (price, provider, outcome)Yes, this is the ledgerNoKept for accounting and tax obligationsExportable from your history
Files you uploadYes, in your file library, billed onceOnly when a call you make uses themUntil you delete themDelete any time
Company memory (brain)Yes, scoped to your workspaceNoUntil you clear itEdit or clear from the app
GitHub profile dataThe computed score and its inputs, public data onlyNoRefreshed at most daily; kept while connectedDisconnect any time; the read:user grant is revocable at GitHub
Provider credentialsHeld server-side, encryptedInjected per validated call, never returned in a responseRotated by VaayaNot applicable, they are Vaaya's accounts

Questions, security reports, or partnerships

Email hello@vaaya.ai, or open an issue in the public MCP repository. Legal and privacy contacts are listed in our Privacy Policy and Terms.