Security

Audion Docs AI v3 can send document text to external LLM providers.

Use it only for documents you are authorized to transmit to the selected provider.

For Russian audit reports, language repair may send only rejected problem / recommendation fields and their short source quotes to one fallback provider when the original provider fails repair. The fallback chain is OpenAI/xAI → Gemini and Gemini/Anthropic → OpenAI. Therefore, a run can transmit these small excerpts to two providers. Configure only provider keys whose services are authorized for the document.

Secrets

Never commit real API keys.

Supported local key locations:

• config\api_key_openai.txt
• config\api_key_gemini.txt
• config\api_key_xai.txt
• config\api_key_anthropic.txt

These files can contain multiple labeled keys, one per line, for example:

copymain | sk-... | primary account
backup = sk-... # lower quota reserve

GUI key favorites are stored in config\gui_key_cache.json; it should contain only key references/labels, not raw keys.

Supported environment variables:

• OPENAI_API_KEY
• GEMINI_API_KEY
• XAI_API_KEY
• ANTHROPIC_API_KEY

The GitHub cleanup script removes generated artifacts and root-level API-key leftovers. Check and sanitize config\api_key_*.txt manually before publishing:

copycleanup_project.cmd

Private Data

Do not commit private documents or generated artifacts that may contain document text:

• input\
• output\
• cache\
• logs\
• work\

Runtime Artifacts

The portable runtime and dependency caches are local/generated artifacts, not source:

• runtime\
• wheelhouse\
• system_core\powershell\
• system_core\fzf.exe

Rebuild them locally with the install/build scripts.