What BYOK means in Rereflect
Many AI SaaS tools include a hosted AI backend as part of the subscription. You pay them; they call a model provider on your behalf, mark up the cost, and the bill is bundled into your seat price. There is nothing wrong with this model, but it means you do not choose the provider, you cannot audit what gets sent to the model, and you are paying a markup on compute that is hidden in the subscription price.
Rereflect does not work that way. There is no Rereflect AI backend. If you want LLM-powered analysis — sentiment with nuance, pain point extraction, feature request tagging, urgency reasoning — you configure a key from a provider you have signed up with directly. Rereflect calls that provider's API on your behalf using your credential. You pay the provider at their published rates. Rereflect adds no markup.
This is what BYOK means in practice: the model provider relationship is between you and them, not mediated or marked up by Rereflect.
How Rereflect stores your key
When you enter an API key through the settings UI, Rereflect encrypts it before writing it to the database. The encryption uses AES-256-GCM with a key you supply through the LLM_ENCRYPTION_KEY environment variable when you start the stack. This is a 32-byte secret that lives on your infrastructure — Rereflect never sees it, because Rereflect never runs the stack for you.
At analysis time, the worker retrieves the encrypted key, decrypts it in memory using LLM_ENCRYPTION_KEY, and passes it in the Authorization header of the LLM API request. The decrypted key is never written to disk or logged. After the request completes, the in-memory credential is discarded.
If someone extracts the database without also having LLM_ENCRYPTION_KEY, they get the ciphertext but not a usable key. Protecting LLM_ENCRYPTION_KEY is therefore important — treat it like a master secret, store it in a secrets manager if you have one, and rotate it if you believe it has been compromised.
- Keys are encrypted with AES-256-GCM before database storage.
- LLM_ENCRYPTION_KEY lives only on your infrastructure and is never sent to Rereflect.
- Decryption happens in memory, at request time, in the Celery worker.
- The decrypted key is not logged, not written to disk, and not held beyond the request lifecycle.
Which providers work
Rereflect uses the OpenAI-compatible API format for all LLM calls. Any provider that exposes an OpenAI-compatible endpoint works — you configure a base URL and a model name alongside the key.
Providers known to work include OpenAI (gpt-4o, gpt-4o-mini, o3-mini), Anthropic (via their OpenAI-compatible endpoint), Google Gemini (via the OpenAI-compatible shim), Groq, Together AI, and any local runtime that speaks the same API format: Ollama, llama.cpp server, LM Studio, vLLM.
For local runtimes, the key field can be left blank or set to a placeholder string — local servers typically do not authenticate and will accept or ignore the Authorization header.
| Provider | Key required | Base URL needed |
|---|---|---|
| OpenAI | Yes | No (uses default) |
| Anthropic (OpenAI-compatible endpoint) | Yes | Yes |
| Groq | Yes | Yes |
| Together AI | Yes | Yes |
| Ollama (local) | No | Yes (localhost) |
| llama.cpp server (local) | No | Yes (localhost) |
| vLLM (local) | Optional | Yes |
What each analysis call sends to the model
Understanding what is in the LLM request helps you make an informed decision about which provider to use. When Rereflect analyzes a piece of feedback, it constructs a prompt that contains: the feedback text itself, the analysis task description (classify sentiment, extract pain points, etc.), and any custom category definitions you have configured.
The prompt does not include other customers' feedback, account details beyond what you have added to the item, or internal system data. The scope is: this text, this task. You can inspect the exact prompt templates in the open-source codebase if you want to audit precisely what is sent.
The no-key fallback
If you do not configure any LLM key, Rereflect falls back to VADER for sentiment analysis. VADER runs entirely in-process, makes no network calls, and has no dependency on an external provider. You get sentiment scores on every piece of feedback from day one — the more advanced LLM steps are available when you add a key later.
This means you can evaluate Rereflect on your real data before committing to an LLM provider or signing up for any API account. Start with VADER, verify the ingestion pipeline works and the UI makes sense for your team, then add a key when you are ready for deeper analysis.