Trust controls for auditable AI spend.
TokenPilot keeps provider keys server-side, scopes dashboard access by workspace, records structured usage logs, and redacts upstream diagnostics before they reach product surfaces.
Workspace security
Current product controls
Encrypted Provider Keys
Provider keys are encrypted at rest and kept out of browser clients. The gateway loads keys server-side before routing provider calls.
Workspace-Scoped Access
Dashboard reads and settings are scoped to the authenticated workspace.
Structured Usage Logs
Usage logs track model, token, cost, cache, agent, and customer metadata for routed requests.
Implemented controls
Security surfaces that match the current product.
These controls describe what TokenPilot exposes today across provider key handling, workspace access, logs, and diagnostics.
Encrypted Provider Keys
ImplementedProvider keys are encrypted at rest and kept out of browser clients. The gateway loads keys server-side before routing provider calls.
Runtime verification labels are exposed in the dashboard without leaking plaintext keys.
Workspace-Scoped Access
ImplementedDashboard reads and settings are scoped to the authenticated workspace.
Owner and admin guards are used for sensitive workspace mutations.
Structured Usage Logs
ImplementedUsage logs track model, token, cost, cache, agent, and customer metadata for routed requests.
Cache hits are logged with zero token usage and zero billed provider cost.
Safe Upstream Diagnostics
ImplementedProvider error diagnostics are structured and redact provider keys, authorization headers, and email addresses.
Diagnostics include bounded metadata such as error class, length, and safe hashes.
Control map
Practical controls for the request path.
Encrypted Provider Keys
Provider API keys are encrypted before storage and are only decrypted server-side for upstream provider calls.
No Provider Keys in Clients
Browser clients call TokenPilot with TokenPilot keys; raw provider keys are not stored in client apps.
Proxy Boundary
Provider execution, budget reserve and settle, response cache, and telemetry stay behind the TokenPilot proxy layer.
Workspace Access Control
Workspace reads and settings updates are scoped by workspace, with owner/admin checks for sensitive actions.
Redacted Provider Errors
Upstream provider errors are summarized with redacted messages and bounded fingerprints instead of raw secrets.
Audit-Ready Usage Data
Structured usage logs and governance events provide a reviewable trail of routed requests and budget outcomes.
Sub-processors
Infrastructure and optional provider dependencies.
Current infrastructure providers and optional LLM providers visible from the product surface.
| Vendor | Purpose | Data location |
|---|---|---|
| Supabase | Database & Auth | US / EU |
| Stripe | Payment processing | US / EU |
| Vercel | Compute & CDN | US / EU |
| OpenAI | LLM inference when configured | US |
| Anthropic | LLM inference when configured | US |
Have a security question?
Contact us for security reviews, implementation questions, or enterprise questionnaire support.