Is a free AI API safe to use? You don’t have to trust us
Every fact you can verify is right here; if you still have doubts, run it in a way that doesn’t require trusting us at all.
Your concerns, and what we do about them
| Your concern | The facts | Still unsure? Do this |
|---|---|---|
| Will my code be kept or sold? | Normal requests leave no content behind — only things like time and usage are recorded | Use only your own computer |
| Can the owner of the computer doing my work see my content? | Every frame is encrypted; that computer doesn’t know who you are | Use official nodes only |
| Could a free API make Claude Code run rogue commands or steal files? | The API only returns text; commands are run by Claude Code on your computer, which asks first by default | Run it in a container |
| What if my key leaks? | Keys can only call models and can’t reach your servers or account | Revoke with one click; unused guest keys expire automatically |
| Could I be charged unexpectedly? | Guests have no payment method; a balance is used only when points run short | Set a daily limit per app |
How the encryption works
- Your browser to TutuCompute: HTTPS.
- TutuCompute to the computer doing your work: an extra encryption layer inside the channel, with every frame encrypted on its own.
- Every connection uses fresh temporary keys, so recorded traffic can’t be decrypted later.
- The computer verifies the platform with a built-in public key, so no one in the middle can swap in their own key.
Run Claude Code / Codex in a container
Start a container that mounts only the current project, then paste and run the command copied from the console.
docker run --rm -it \ -v "$PWD":/work -w /work \ --cap-drop ALL --security-opt no-new-privileges \ node:22 bash
- It can’t see your home folder, SSH keys or cloud credentials
- Everything is gone when you exit
- Commit with git first so you can always roll back
FAQ
Normal requests leave no content behind — only things like time and usage are recorded. Only a request that matches an abuse rule is kept, encrypted, for review.
No. The request it receives carries no identity, and every frame of content is encrypted.
Keys can only call models and can’t reach your servers or account; revoke it with one click on the connect page.
Commands are run by Claude Code on your own computer, which asks before each one by default; inside a container it can only touch the current project.
Yes. Any key can be set to use official nodes only, or you can use only your own computer.
Guests have no payment method. Signed-in users only pay from their balance when points run short and a balance exists, and every app can have a daily limit.
Related
Is a free AI API safe to use? You don’t have to trust us