He-API's provider keys are encrypted at rest with AES-256-GCM and decrypted only in memory; the gateway polls an internal active providers endpoint every 30 seconds and atomically replaces the provider set in memory, thereby achieving hot reload.