Privacy architecture

Design principle

Tokeven is built around one constraint: prompt content from your instrumented traffic never reaches us.

The wrapper (or the self-hosted sidecar) runs in your environment, reads the usage field from API responses, and pushes usage metadata to our servers. Prompt and completion content is never transmitted to Tokeven. Cost is computed on our side from the token counts.

What we receive

Every field a usage event can carry, taken from the same list the Privacy Policy renders:

• •Event ID - a random identifier your client generates so a retry is not counted twice
• •Timestamp - when the call happened
• •Model ID - which model you called
• •Provider name - Claude, ChatGPT, Gemini or Grok
• •Modality - text, code, vision or audio
• •Input token count - how many tokens went in
• •Output token count - how many tokens came back
• •Cache-read token count - tokens served from the provider's prompt cache
• •Cache-write token count - tokens written to the provider's prompt cache
• •One-hour cache-write token count - the part of the cache-write count written with a one-hour lifetime, which the provider bills at a higher rate
• •Prompt length - a character count computed on your machine - never the text itself
• •Request latency - how long the call took
• •Batch flag - whether the call used the provider's discounted batch tier, so we price it correctly (only when the call has one)
• •Speed tier - which processing speed your provider served (e.g. standard, flex, fast, ultrafast), so faster-and-pricier calls are priced correctly (only when the call has one)
• •Original speed tier - when you accept a suggestion to drop to a slower, cheaper speed tier, the tier you would otherwise have used, so the saving is priced exactly (only when the call has one)
• •Moved to batch - when you accept a suggestion to send calls through a provider's batch API instead, a yes/no flag so the saving is priced exactly (only when the call has one)
• •Web searches - how many web searches your provider ran for the call (a count only, never the query or results), so its per-search fee is priced (only when the call has one)
• •File searches - how many hosted file searches your provider ran for the call (a count only, never the query or results), so its per-call fee is priced (only when the call has one)
• •Audio input tokens - how many of the input tokens were audio (a count only, never the audio), so audio is priced at its own rate (only when the call has one)
• •Audio output tokens - how many of the output tokens were audio (a count only, never the audio), so audio is priced at its own rate (only when the call has one)
• •Cloud platform or gateway - whether the call went through AWS Bedrock, Google Vertex, Azure or a gateway such as OpenRouter rather than the provider directly (only when the call has one)
• •Gateway charge - what a gateway such as OpenRouter reported charging for the call, a dollar amount only, so we can show what you actually paid (only when the call has one)
• •Event kind - whether the call was billed per-token by your provider or covered by a flat-rate subscription
• •Session identifier - groups calls that belong to one working session (only when the call has one)
• •Project label - a name you choose to group calls by project (only when the call has one)
• •Tool name - the name of a tool the model called, where your client reports one - the name only, never its arguments (only when the call has one)
• •Advisor used - whether you acted on a pre-send recommendation for this call
• •Advisor available - whether a recommendation existed for this call at all - the denominator that makes the figure above meaningful (only when the call has one)
• •Original model ID - the model you moved away from, when you took a recommendation - this is what a savings figure is measured against (only when the call has one)
• •Original output token count - an upper bound your client reports so a savings figure cannot be overstated (only when the call has one)
• •Attribution miss reason - a short code from a fixed list saying why a recommendation was not credited (for example, the model was unchanged) (only when the call has one)

Off by default, sent only if you turn it on:

• •Actor label - a label naming who ran the call - off by default, and you choose what it holds. If you set it to an email address, that address is sent with each call

What we never receive

• •Prompt content
• •Completion content
• •Your API keys
• •File contents
• •System prompts
• •Tool call arguments

Why this matters

Many companies prohibit storing employee prompt content. Our architecture means you get cost analytics without sending it to us. A few opt-in tools outside your instrumented traffic do process text you explicitly submit - Prompt Revision, advisor.improve() and the dashboard AI assistant - and they are listed in Privacy Policy §2.4. See our Security & Privacy page for more details.