tokevenPrivacy & Security
Your IP stays yours. We only see the bill.
Tokeven was designed around one constraint: never touch what makes your AI usage valuable. Your instrumented traffic is metrics-only - token counts and cost. The ingest payload has no field for prompt or completion text, so your production prompts can’t reach us even by accident. Two opt-in tools are the only exceptions, and we name them below.
Privacy by design
Three things that will never change
Your traffic is metrics-only
The Tokeven wrapper runs in your environment and reads token counts from API responses. Prompts and completions from your instrumented traffic are never captured, transmitted, or stored - the ingest schema has no field that could carry them.
We never hold your API keys
Your Anthropic, OpenAI, Google, and xAI credentials stay on your machines. Tokeven authenticates with its own write-only ingest tokens, completely separate from your provider keys.
We only receive metadata
Model and provider IDs, token counts, latency, cost estimate, session and project labels. No prompt text. No completion text. No file contents. Nothing read out of your prompts.
What we receive vs. what stays local
Sent to Tokeven
- Event ID
- Timestamp
- Model ID
- Provider name
- Modality
- Input token count
- Output token count
- Cache-read token count
- Cache-write token count
- Prompt length
- Request latency
- Batch flag
- Event kind
- Session identifier
- Project label
- Tool name
- Advisor used
- Advisor available
- Original model ID
- Original output token count
- Attribution miss reason
- Actor label, only if you set one (see below)
Never in what we ingest
- Prompt content
- Completion content
- File contents
- Your API keys
- System prompts
- Tool call arguments
- User data in prompts
- Anything derived from your prompt text
Two opt-in exceptions - both off unless you invoke them, neither ever touches your instrumented traffic: (1) Prompt Revision(dashboard tool): prompt text you paste is sent to Anthropic for rewriting via Tokeven’s server - don’t paste secrets. (2) advisor.improve() / tokeven improve: sends the prompt you’re improving to Anthropic using your own API key; it never passes through Tokeven’s servers.
Two optional identifiers you choose to send - both unset by default: (1) Actor (TOKEVEN_ACTOR): a label naming who made a call, so your team can see who drives spend. You decide what it holds - a work email address, a username, or a service name. It is a label you pick, never anything read out of your prompts, and leaving it unset means your calls carry no personal identifier at all. (2) tokeven reconcile: sends daily totals from your provider’s own billing report so you can see what share of your real spend we measure. The provider admin credential it needs is used on your machine and never transmitted - no Tokeven endpoint accepts one. Full detail in the privacy policy.
Architecture
How data flows
Wrapper reads token counts from API responses locally
Metadata sent to /ingest over HTTPS (TLS in transit)
Cost computed from token counts, stored with org-level isolation
Aggregated spend views. Never raw prompts.
Security implementation
Ingest tokens hashed at rest
Ingest tokens (tkv_ing_...) are stored as SHA-256 hashes. The raw token is returned once at creation. If lost, revoke and create a new one.
Passwords bcrypt-hashed
User passwords are hashed with bcrypt at cost factor 12. Plaintext passwords are never stored.
Short-lived access tokens
JWTs expire in 15 minutes; refresh tokens after 7 days. The refresh token is an httpOnly cookie scoped to the auth route, so JavaScript cannot read it and an XSS on your session cannot exfiltrate a seven-day credential. The 15-minute access token does still live in browser localStorage, stated plainly because a reviewer will check: an XSS could read that one, which is why its life is 15 minutes and why revoking a session invalidates the refresh token server-side. Authorization headers are scrubbed from all server logs.
Accuracy
How we calculate cost and prove savings
Exact token counts from the API response
The wrapper reads input_tokens, output_tokens, cache_read_input_tokens, and cache_creation_input_tokens directly from the provider's response.usage block. These are the same numbers the provider uses to bill you.
Cache-aware pricing
Cache-read tokens cost 0.1x the input rate. Cache-creation is priced per model, not by a blanket rule: Anthropic and the GPT-5.6 family charge 1.25x the input rate to write a prefix into cache, while Google, xAI and the OpenAI models before GPT-5.6 charge nothing extra for the write. We apply the multiplier our registry holds for the exact model you called, so your cost reflects what you actually pay, including prompt caching discounts.
Server-side recomputation
Even though the wrapper computes a cost estimate locally, the server always recomputes cost from raw token counts using the canonical pricing table. This prevents client-side tampering and keeps pricing centralized.
Live pricing for savings
Savings are calculated against current token prices per model, not a frozen baseline. When provider pricing changes, the math updates automatically. Every savings claim is the delta between what you would have spent and what you actually spent.
Auditable to the event level
Every savings claim links to the specific usage events that caused it. You can drill into any number and see the individual calls, models, and token counts behind it.
Privacy Policy
Full details on what data we collect, how we use it, and your rights.
Read privacy policyTerms of Service
Your agreement with Tokeven, LLC, including acceptable use, liability, and data handling.
Read terms of serviceQuestions about privacy or compliance?
We will walk through our architecture, share our data handling methodology, or answer compliance questions. Enterprise reviews - dedicated account manager, SLA, security questionnaire - go through sales.