tokevenPrivacy & Security
Your IP stays yours. We only see the bill.
Tokeven was designed around one constraint: never touch what makes your AI usage valuable. Your instrumented traffic is metrics-only — token counts and cost. The ingest payload has no field for prompt or completion text, so your production prompts can’t reach us even by accident. Two opt-in tools are the only exceptions, and we name them below.
Privacy by design
Three things that will never change
Your traffic is metrics-only
The Tokeven wrapper runs in your environment and reads token counts from API responses. Prompts and completions from your instrumented traffic are never captured, transmitted, or stored — the ingest schema has no field that could carry them.
We never hold your API keys
Your Anthropic, OpenAI, and Google credentials stay on your machines. Tokeven authenticates with its own write-only ingest tokens, completely separate from your provider keys.
We only receive metadata
Model ID, token counts, latency, cost estimate, and a session ID. That is the complete list. No prompt text. No completion text. No file contents. No user data.
What we receive vs. what stays local
Sent to Tokeven
- Model ID
- Input token count
- Output token count
- Cache-read / cache-write counts
- Request latency
- Computed cost
- Session ID
- Timestamp
Never in what we ingest
- Prompt content
- Completion content
- File contents
- Your API keys
- System prompts
- Tool call arguments
- User data in prompts
Two opt-in exceptions — both off unless you invoke them, neither ever touches your instrumented traffic: (1) Prompt Revision(dashboard tool): prompt text you paste is sent to Anthropic for rewriting via Tokeven’s server — don’t paste secrets. (2) advisor.improve() / tokeven improve: sends the prompt you’re improving to Anthropic using your own API key; it never passes through Tokeven’s servers.
Architecture
How data flows
Wrapper reads token counts from API responses locally
Metadata sent to /ingest over HTTPS (TLS in transit)
Cost computed from token counts, stored with org-level isolation
Aggregated spend views. Never raw prompts.
Security implementation
Ingest tokens hashed at rest
Ingest tokens (tkv_ing_...) are stored as SHA-256 hashes. The raw token is returned once at creation. If lost, revoke and create a new one.
Passwords bcrypt-hashed
User passwords are hashed with bcrypt at cost factor 12. Plaintext passwords are never stored.
Short-lived access tokens
JWTs expire in 15 minutes. Refresh tokens handle re-authentication. Authorization headers are scrubbed from all server logs.
Accuracy
How we calculate cost and prove savings
Exact token counts from the API response
The wrapper reads input_tokens, output_tokens, cache_read_input_tokens, and cache_creation_input_tokens directly from the provider's response.usage block. These are the same numbers the provider uses to bill you.
Cache-aware pricing
Cache-read tokens cost 0.1x the input rate. Cache-creation tokens cost 1.25x. We apply the correct multiplier per token type so your cost reflects what you actually pay, including prompt caching discounts.
Server-side recomputation
Even though the wrapper computes a cost estimate locally, the server always recomputes cost from raw token counts using the canonical pricing table. This prevents client-side tampering and keeps pricing centralized.
Live pricing for savings
Savings are calculated against current token prices per model, not a frozen baseline. When provider pricing changes, the math updates automatically. Every savings claim is the delta between what you would have spent and what you actually spent.
Auditable to the event level
Every savings claim links to the specific usage events that caused it. You can drill into any number and see the individual calls, models, and token counts behind it.
Privacy Policy
Full details on what data we collect, how we use it, and your rights.
Read privacy policyTerms of Service
Your agreement with Tokeven, LLC, including acceptable use, liability, and data handling.
Read terms of serviceQuestions about privacy or compliance?
We will walk through our architecture, share our data handling methodology, or answer compliance questions.
Contact us