Privacy architecture

Design principle

Tokeven is built around one constraint: prompt content never reaches us.

The wrapper runs in your environment, reads the usage field from API responses, and pushes metadata to our servers. Prompt and completion content is never transmitted to Tokeven.

What we receive

• •Model ID
• •Token counts (input, output, cache-read, cache-write)
• •Request latency
• •Computed cost
• •Session ID
• •Timestamp

What we never receive

• •Prompt content
• •Completion content
• •Your API keys
• •File contents
• •System prompts
• •Tool call arguments

Why this matters

Many companies prohibit storing employee prompt content. Our architecture means you get full cost analytics without any privacy trade-off. See our Security & Privacy page for more details.