How QwenCloud secures your data
QwenCloud is designed to protect your data at every layer — from API requests to model inference. This page describes the key security measures in place.
QwenCloud serves models from multiple regions. Three things determine where your resources and data are:
If you have data residency or compliance requirements, choose the region where your data must be stored and a service deployment scope with a matching geographic boundary. See Regions and endpoints.
API keys authenticate every request to QwenCloud. Follow these practices to keep your keys safe:
All API requests pass through automatic content moderation that screens both inputs and outputs for harmful, illegal, or inappropriate content.
As a developer building on QwenCloud, you share responsibility for the safety and security of your application:
Encryption
| Layer | Standard |
|---|---|
| Data in transit | TLS 1.2 or later for all API connections |
| Data at rest | AES-256 encryption for stored data (API keys, account information) |
Regions and data location
QwenCloud serves models from multiple regions. Three things determine where your resources and data are:
| Question | Answer |
|---|---|
| Which region a resource belongs to | The region where you created it. Workspaces and API keys stay in that region and are not copied to other regions. |
| Where inference runs | The service deployment scope of the workspace. Some scopes keep inference within a specific geographic boundary, such as the EU or Japan. |
| Where request data is stored | The region whose endpoint you call. |
API key security
API keys authenticate every request to QwenCloud. Follow these practices to keep your keys safe:
- Never hardcode keys in source code or commit them to version control. Use environment variables or a secrets manager.
- Use separate keys for development and production environments.
- Rotate keys regularly. You can create new keys and delete old ones from the API Keys page.
- Restrict access by creating keys in specific workspaces with appropriate permissions.
Content moderation
All API requests pass through automatic content moderation that screens both inputs and outputs for harmful, illegal, or inappropriate content.
Responsible AI practices
As a developer building on QwenCloud, you share responsibility for the safety and security of your application:
- Implement input validation before passing user content to the API.
- Set appropriate
max_tokenslimits for your use case. - Add rate limiting at the application layer to prevent abuse.
- Monitor both inputs and outputs for content safety using QwenCloud's built-in content moderation.
Learn more
- Audit & access Logs: Track API usage for compliance.