Responsible AI

Dino uses AI to analyze and test your APIs, to reason over scan data, to power the Dojo AI assistant, and to run Sentinel, which observes API behavior and can suggest or act on quality and security signals. This page explains what we send to AI models, our commitments on training, and the human controls on autonomous behavior.

Models and providers

Dino uses large language models from Anthropic and OpenAI, and Cloudflare Workers AI, depending on the feature and configuration. Our current providers are listed on our Sub-processors page. Model versions may change as providers release new ones.

What we send to models

• We send the content needed for analysis: API structure, scan requests and responses, and findings context.
• We redact secrets before any content reaches a model. Credential values, tokens, cookies, and sensitive headers are not included in model prompts. See our Credential Handling page.
• We send a model only what it needs for the task.

Training

Dino does not use your data to train models, and Dino does not operate its own foundation models. Dino configures its model providers so that content sent for inference is not used to train their models. When you use bring-your-own-key, requests run under your own provider account and terms.

Human control over autonomous behavior

Sentinel operates in graduated modes, and the higher modes keep a human in the loop:

• Observe: Sentinel watches and reports.
• Suggest: Sentinel proposes actions for you to review.
• Write and Enforce: available on higher tiers, where actions are surfaced for human approval before they take effect, rather than acting unilaterally.

Accuracy and honesty

Dino is built to avoid false confidence. When a scan cannot test something, Dino marks it as not tested rather than reporting it as clean, and findings distinguish what was verified from what was not. AI output is a recommendation for you to review, not a guarantee.

Bring your own key

You can supply your own model-provider key. In that mode, AI requests run under your own account, giving you direct control over where AI processing happens and under what terms.

Contact

Raise AI behavior concerns to support@usedino.dev.