An LLM proxy sees everything your coding agent sends: code, file contents, tool output and replies, usually with your provider credential. It is not unsafe by default, but it adds a party that reads your code in plain text. Safety depends on what the operator stores, for how long, where it runs and who can reach it, so get the answers in a DPA rather than a landing page.
- It reads everything. Any proxy that does useful work terminates TLS and sees the full request.
- Retention and keys are the big risks. Stored prompts and stored keys are what can leak.
- Get it in writing. Terms, privacy policy and DPA beat marketing copy.
What a proxy can see
Each agent request carries the system prompt, CLAUDE.md, tools, every file read, command output and the conversation so far. TLS protects the hops, not the content from the proxy itself.
| Data | Visible to the proxy | Why it matters |
|---|---|---|
| Source code and file contents | Yes, in plain text | Proprietary code and anything the agent opened |
| Secrets in files or output | Yes, if the agent read them | A .env file or a token in a log becomes part of the prompt |
| Provider credential | Usually, on every request | Storing or logging it widens the blast radius |
| Model responses | Yes | Generated code and reasoning about your system |
| Request metadata | Yes | Timing, model, token counts, account identity |
The real risks
Six ways a proxy adds exposure. Most are about what the operator keeps.
- 1Retention
Logged prompts are a copy of your code somewhere new, for as long as they are kept.
- 2Credential handling
A proxy that stores raw provider keys becomes a place to steal them.
- 3Training use
Some services reuse traffic to improve products unless you opt out.
- 4Jurisdiction
Where the proxy runs decides which law governs the data.
- 5Operator access
Who on the vendor side can read traffic, and whether it is recorded.
- 6Availability
One more dependency. If it goes down, your agent stops unless you can bypass it.
Questions to ask any vendor
A certification described as in progress should not be marketed as done.
| Topic | Ask |
|---|---|
| Keys | Do you store my provider key, or only forward it? |
| Content | Do you store prompts and responses? For how long, and can it be zero? |
| Training | Do you train on or reuse customer traffic? |
| Region | Where is the application hosted, and where are requests processed? |
| Subprocessors | Who are your subprocessors? |
| Contracts | Will you sign a DPA, and do you support GDPR export and erasure? |
| Staff access | How do staff reach production, and is privileged access audited? |
| Certifications | Which do you hold, and which are only in progress? |
| Outages | What happens to my agent if you are down? |
Reduce exposure on your side
- 1Keep secrets out of reach
Out of the working tree, or denied in the agent's permission settings.
- 2No credential dumps
Do not let the agent print environment variables or credential files.
- 3Use a separate key
A dedicated provider key for proxied traffic rotates without touching anything else.
- 4Review it like any processor
Put the proxy in the same review as any other processor of source code.
How condense answers
condense is a hosted proxy, so all of the above applies to us. From our security page and security controls docs:
| Question | condense |
|---|---|
| Provider key | Forwarded, never stored; only a sha256 fingerprint for usage attribution |
| Content retention | Deleted after 7 days of inactivity; zero data retention on request |
| Training | Never trains on your data |
| Hosting | AWS Europe (Spain); api.us.condense.chat is processed in the US with content held in memory only |
| Encryption | TLS 1.2+ with HSTS in transit, AES-256 at rest |
| Operator access | Private network with enforced 2FA; privileged actions in an append-only audit trail |
| Contracts | DPA available; GDPR export and erasure supported |
| Certifications | SOC 2 Type II and ISO 27001:2022 in progress, not complete |
Model providers have their own processing locations, so not every hop stays in the EU; see the subprocessor page. The dense CLI is open source, and an organization gives admins one place to manage who routes traffic.
Frequently asked questions
Can an LLM proxy see my source code?
Yes. A proxy that compresses, routes or logs requests reads file contents, diffs and tool output in plain text; TLS protects the connection, not the content from the operator.
Does an LLM proxy see my API key?
Usually, on every request, so ask whether it is stored, logged or only forwarded. condense forwards it and keeps only a sha256 fingerprint for usage attribution.
Is a self-hosted LLM proxy safer than a hosted one?
It removes one outside party, but you then own patching, access control and logging. A hosted proxy is reasonable when its retention, hosting and contract terms meet your requirements.
Does using a proxy violate my Claude or OpenAI terms?
Routing API traffic through a gateway is common, but terms differ by provider and plan and change over time. Read your current terms and your company policy on additional processors.
What does condense store?
Your provider key is never stored, content is deleted after 7 days of inactivity with zero retention on request, and condense never trains on your data. Hosting is AWS Europe (Spain); api.us.condense.chat is processed in the US.