Your Gemini API key

PaperLM runs on your own Google Gemini API key. This page says exactly what we do with it: where it is kept, who can use it, what it is used for, and what happens when you delete it. Everything here is checked against the code in our key protection audit.

In short

  • Your key is encrypted with Google Cloud KMS before it is stored, and it is stored in a database that holds nothing else and is set up with no backups.
  • Only our two server processes can decrypt it, and every decryption is logged by Google Cloud. A decryption by anyone else raises an alert.
  • It is used only for work you start, and it is sent only to Google.
  • You never see it again after you save it. We keep the last four characters so you can tell which key is saved.
  • Deleting it in Settings deletes the stored key first, before anything else, and stops your queued analyses.

When you save it

  1. We check that it looks like a Gemini API key. If it does not, nothing is sent anywhere.
  2. We ask Google whether the key works, with one request that lists the available models. This request is free; it spends no tokens.
  3. If Google does not accept the key, we tell you why in our own words and store nothing.
  4. If it works, we encrypt it and store it. Your account records only that a key is saved and its last four characters.

Where it is kept

The encrypted key lives in a separate database that holds users' keys and nothing else, in Google Cloud's europe-west1 region (Belgium). That database is created with no point-in-time recovery and no backup schedule, and our deploy refuses to proceed if it finds either turned on, so a deleted key is gone when the deletion finishes. No app user can read it, including you: the browser never receives the key or its encrypted form.

The encryption key that protects it is held by Google Cloud KMS and never leaves it. Only two service accounts may use it: the PaperLM API and the PaperLM analysis worker. Google Cloud records every use in its audit log, and we are alerted if any other identity decrypts a key.

What it is used for

Your key is used only for things you start:

  • paper analyses and reruns of their stages,
  • chat about a paper, and updating a review from chat,
  • workspaces: chat, combined reviews, documents and Deep Research, and the images, comics, social posts and translations made from them.

It is sent only to Google's Gemini API, in a request header, never in a web address. All of this usage is billed to your Google account.

Google Search. In a paper analysis, three stages ask Gemini to search the web with Google Search: the review, the critique and the roast. Chat about a paper and workspace chat let Gemini search the web with Google Search and read web pages linked in your messages (URL context); both are on by default, and the Web search and Read URLs buttons in the chat switch them off. Deep Research in workspaces is a Google research agent that searches the web by design. Search is billed on your key like any other Gemini usage.

Uploaded files. When you switch on Ground on PDFs in a workspace chat, we upload the workspace's paper PDFs to Google's Files API with your key. Google deletes these files after 48 hours.

Cached content. During an analysis, the paper's PDF is also placed in Gemini's context cache with your key, so the extraction step can ask several questions about it. We delete that cache as soon as the step ends; Google expires it after 15 minutes at most in any case.

How Google treats what is sent with your key is governed by the Gemini API terms for your key's tier (free or paid).

What we never do

  • We never write your key, or anything derived from it, to our logs. Error messages from Google are scrubbed of your key, and of anything shaped like a key, before they are logged, stored or shown. Automated tests check this on every change.
  • We never put your key in the queue that carries analysis jobs. The worker fetches it when a job starts.
  • We never show it to anyone. Our admin screens show only whether a key is saved.

When you delete it

Deleting your key in Settings, or deleting your account, does this, in order:

  1. deletes the encrypted key — first, so nothing after it can leave the key behind;
  2. clears the saved-key flag and the last four characters;
  3. forgets the uploaded-file references on your papers, and stops your queued and running paper analyses that use your key;
  4. asks Google to delete the PDFs we uploaded to its Files API with your key. This step has a time limit of about 20 seconds. If it is interrupted — by that time limit, a server restart, or our failing to unlock the key to clean up — or a delete fails, the files it did not delete are deleted by Google 48 hours after the upload. Deleting again cannot reach them: the key they need is already gone.

Nothing new can start with a deleted key. Work that is already running holds the key in memory until it stops:

  • a running paper analysis stops when its current stage ends;
  • other running jobs, such as a workspace review, finish first;
  • a Deep Research task runs at Google, not on our servers, so it continues there until it finishes, and we stop following it.

None of our jobs runs longer than 30 minutes, the worker's time limit.

Protect your key

  • Create the key in a Google Cloud project you use only for PaperLM.
  • Set a budget alert on that project, or lower its Gemini API quotas for a hard ceiling.
  • Restrict the key to the Generative Language API.
  • If you suspect the key has leaked, delete it in Google AI Studio and save a new one here.

Questions

Write to [email protected].