Security

This page summarizes how Asksemble, a Lukreative product, protects accounts, prompts, and API credentials today. It is a product overview, not a formal certification report.

Authentication

User identity is handled by Clerk. Product APIs require a signed-in session (or Bearer token) before orchestrating runs, listing History, or managing Skills. Unauthenticated callers receive unauthorized responses.

Transport

Production deployments should serve Asksemble exclusively over HTTPS so credentials and prompts are encrypted in transit between your browser and the application.

API keys

• Browser keys — optional overrides in Model settings remain in local browser storage and are sent with orchestration requests only when you configure them.
• Server keys — operator keys live in environment variables and are not shipped to the client.

Data isolation

Runs and Skills are associated with your Clerk user ID. Other users cannot list or mutate your records through the normal API surface.

Anonymized voting

In the Vote stage, models receive anonymized synthesis drafts so votes are based on content quality rather than model brand labels. This reduces one class of bias in the consensus outcome.

Demo mode

The interactive demo replays canned pipeline events in the browser. It does not authenticate, does not call provider APIs, and does not write runs to the database.

Payments

Paid plans (Pro, Team) are collected through PhonePe Standard Checkout. Card and UPI details are entered on PhonePe; Asksemble stores order metadata and plan entitlements only. See Billing.

Responsible disclosure

If you find a security issue in Asksemble, report it privately to Lukreative via lukreative.com before public disclosure.

Related

Privacy Policy · Terms of Service