What is BYOK (Bring Your Own Key)?
Bring Your Own Key (BYOK) means a customer supplies its own credential, such as an AI provider API key or an encryption key, for a software service to use on its behalf. For AI features, the provider bills the customer directly for model usage, and the customer keeps its own contract, data terms and usage records with that provider.
How Personal Academy handles it
Personal Academy lets Premium organisations use their own AI key, stored encrypted with AES-256-GCM, and BYOK calls still cost 25 percent of the normal credit price.
A worked example
Suppose a 300-person law firm has already negotiated data terms with an AI provider and wants every AI feature in its learning platform to run under that agreement. An administrator pastes the firm API key into the AI settings. From then on, AI drafts and answers are billed by the provider to the firm, and the learning platform charges a reduced number of credits for running the feature.
Software products that include AI features usually call a model provider with their own account and pass the cost on to customers in some form. Bring Your Own Key reverses part of that arrangement: the customer creates an account with the provider, generates a key, and gives it to the product, which then makes calls with that key.
Organisations choose BYOK for three main reasons. The first is contract control: they may have negotiated data processing, retention or regional terms with a provider and want every call covered by that agreement. The second is visibility: usage appears in their own provider console, alongside other projects. The third is cost management: they may have committed spend or discounts with the provider.
BYOK does not remove the product from the path. The product still builds the prompts, applies its own guardrails, stores results and runs the feature. That is why many vendors charge a reduced platform fee for BYOK calls rather than nothing at all.
Security of the stored key matters. A sound design encrypts the key at rest with a strong algorithm such as AES-256-GCM, keeps the decryption key outside the database, restricts reading the key to server-side code, and never sends it back to the browser after it is saved. Rotating or revoking the key should be possible at any time.
The same term is used in cloud security for customer-managed encryption keys, where a customer supplies the key that encrypts its stored data. The ideas are related, but the AI version is about who holds the provider account, not about storage encryption.