Security controls

Trust controls for auditable AI spend.

TokenPilot keeps provider keys server-side, scopes dashboard access by workspace, records structured usage logs, and redacts upstream diagnostics before they reach product surfaces.

Workspace security

Current product controls

Implemented

Encrypted Provider Keys

Provider keys are encrypted at rest and kept out of browser clients. The gateway loads keys server-side before routing provider calls.

Workspace-Scoped Access

Dashboard reads and settings are scoped to the authenticated workspace.

Structured Usage Logs

Usage logs track model, token, cost, cache, agent, and customer metadata for routed requests.

Implemented controls

Security surfaces that match the current product.

These controls describe what TokenPilot exposes today across provider key handling, workspace access, logs, and diagnostics.

Encrypted Provider Keys

Implemented

Provider keys are encrypted at rest and kept out of browser clients. The gateway loads keys server-side before routing provider calls.

Runtime verification labels are exposed in the dashboard without leaking plaintext keys.

Workspace-Scoped Access

Implemented

Dashboard reads and settings are scoped to the authenticated workspace.

Owner and admin guards are used for sensitive workspace mutations.

Structured Usage Logs

Implemented

Usage logs track model, token, cost, cache, agent, and customer metadata for routed requests.

Cache hits are logged with zero token usage and zero billed provider cost.

Safe Upstream Diagnostics

Implemented

Provider error diagnostics are structured and redact provider keys, authorization headers, and email addresses.

Diagnostics include bounded metadata such as error class, length, and safe hashes.

Control map

Practical controls for the request path.

Encrypted Provider Keys

Provider API keys are encrypted before storage and are only decrypted server-side for upstream provider calls.

No Provider Keys in Clients

Browser clients call TokenPilot with TokenPilot keys; raw provider keys are not stored in client apps.

Proxy Boundary

Provider execution, budget reserve and settle, response cache, and telemetry stay behind the TokenPilot proxy layer.

Workspace Access Control

Workspace reads and settings updates are scoped by workspace, with owner/admin checks for sensitive actions.

Redacted Provider Errors

Upstream provider errors are summarized with redacted messages and bounded fingerprints instead of raw secrets.

Audit-Ready Usage Data

Structured usage logs and governance events provide a reviewable trail of routed requests and budget outcomes.

Sub-processors

Infrastructure and optional provider dependencies.

Current infrastructure providers and optional LLM providers visible from the product surface.

VendorPurposeData location
SupabaseDatabase & AuthUS / EU
StripePayment processingUS / EU
VercelCompute & CDNUS / EU
OpenAILLM inference when configuredUS
AnthropicLLM inference when configuredUS

Have a security question?

Contact us for security reviews, implementation questions, or enterprise questionnaire support.