Trust
Who we are, what we claim, and where data lives
Answers to the questions security and procurement teams ask most: how 24Test relates to TBuy, whether test results constitute certification, each product’s data boundaries and retention policy, and the licensing and origin of its code.
Brand relationship
Affiliated brands with distinct roles. No independent certification.
Provides tools for model testing, enterprise access, and API call auditing. Model Check tests the API you specify and produces an evidence report. Token Audit lets enabled enterprise accounts review collected call records and sensitive-information risks. The enterprise gateway gives employees a unified access point.
Provides model APIs and token services to help customers purchase, connect to, and use AI models. TBuy issues enterprise channels and restricted credentials. Its API gateway domain is modelsok.com.
What this means
- 24Test does not claim to be an independent third party. Test results must be interpreted alongside the test conditions, evidence, and applicable scope.
- Results for TBuy’s own channels are reported faithfully, including failures. Reports whose endpoints belong to TBuy hosts will identify that affiliation. This is planned; currently, the affiliated-brand relationship is disclosed in the footer only.
- Token Audit collects from the TBuy gateway and covers only enabled enterprises and their enabled collection scope.
- The audit console contains no purchase or top-up links. Test reports disclose the affiliation without directing users to purchase.
Claims we do not make
- “24Test-certified channel,” “Recommended by 24Test,” or “Audit passed”
- “Zero loss,” “100% stays on your network,” or “Real-time blocking”
- “SOC 2 certified” or “No persistent storage”
- Presenting planned or prototype capabilities as available features
Data boundaries
What each product holds, and for how long
| Product | Data held | Encryption & access | Retention | Data not held |
|---|---|---|---|---|
| 24Test Model Check | Test reports (probe request and response summaries, scores, and evidence), report notes, test history for signed-in users, and test keys users explicitly choose to save. | Keys are consistently redacted in reports, progress streams, the database, and error messages. Saved keys are encrypted with AES-256-GCM; the master key is kept outside the database and backups. | Reports are retained long term. Anyone with the link can open them, and they are not indexed. Saved keys are automatically deleted when they expire. | No email addresses are collected. Tests run while signed out do not appear in any list. Generated images are not stored in the database. |
| Token Audit (SaaS) | Call information for enabled enterprises. Depending on the collection tier, this may include prompts, responses, reasoning content, and tool-call bodies. | Per-tenant data keys (AES-256-GCM), four roles, and database row-level security. An access log is written before content is viewed. Site-owner access additionally requires secondary verification and triggers a notification. | 180 days by default, adjustable per tenant; raw records: 7 days. Once the site owner’s archival public key is configured, content older than 14 days (default, adjustable) is moved to cold storage and encrypted with that offline public key. | Upstream channel identities are excluded from enterprise-visible interfaces. Service logs and alerts contain no content bodies. For base64 images and files, only type, size, and hash are recorded. |
| Token Audit (On-Premises) | As above, with the database and encrypted content held by the enterprise. | As above; manual unlocking is required after a restart. | Configured by the enterprise | The cloud does not receive content bodies (prototype validation in progress). |
| Token Router Enterprise | Employee keys, model permissions, quotas, and call logs; credentials for enterprise-owned channels when using BYOK. | The database and credentials reside on the enterprise’s machine. Provider keys are not distributed to employees. | Configured by the enterprise | Cloud management has not been implemented. Call content is still sent to the selected model upstream. |
Known limits: anyone able to log in to the audit server can technically decrypt content. Access is currently restricted to the site owner; hardware-backed keys are planned. Collection covers only the gateway’s /v1 and /v1beta routes.
Licensing & source code
Separate licensing for each product
24Test Model Check
Derived from new-api and licensed under AGPL-3.0 as a whole. If you run a modified version as a network service, you must provide its source code to users. Source corresponding to the live service and its dependencies is available in the source archive on the same site , with a SHA-256 checksum file. 24Test is not affiliated with Anthropic, OpenAI, Google, or Amazon Web Services.
Token Audit
Independently developed software that does not copy gateway code. The on-premises edition is planned to be open sourced from a clean repository. Its license and release date will be announced separately.
Token Router Enterprise
The gateway core is derived from new-api (AGPL-3.0), with license files included. Source corresponding to the public demo using synthetic data and dependency licenses can be downloaded from the demo site’s source archive . Configuration, data, and credentials are excluded.
Contact
Security reports & business inquiries
Report a vulnerability
The Model Check repository includes security disclosure instructions. Official security contact details will be added here once confirmed by the responsible owner.
Enterprise inquiries
To request a scenario demo or discuss delivery scope, contact details will be added here once confirmed by the responsible owner. For TBuy accounts and enterprise channels, please visit tbuy.ai .