CostKey security and privacy
Useful observability, clear boundaries.
CostKey helps teams understand AI spend while keeping provider traffic, telemetry, capture settings and permissions explicit.
No gateway required.
CostKey does not route your provider requests through a CostKey gateway. Calls still travel from your application to the provider through your existing client and route. The SDK observes supported responses in your process and sends separate, bounded telemetry to CostKey asynchronously.
Two paths, two purposes. Provider traffic carries the request and response. CostKey telemetry carries the configured observation fields. The telemetry path can include metadata and, only when enabled, captured text.
Capture is a project setting.
New projects start with metadata-only capture. Text capture is optional, redaction remains enabled, and the server enforces a metadata-only project even if an older SDK sends body fields.
Metadata only
Usage, model, timing, cost state, stack context and supported labels remain useful without prompt or response bodies.
Text capture
Enable it deliberately when call-content inspection is needed. Configure redaction and retention for the project.
Fail-safe startup. The TypeScript SDK starts with body capture disabled until its authenticated project configuration is known. A local captureBody: false setting remains stronger than a remote text setting.
Access follows the evidence.
Cost and usage metadata can remain available while sensitive call content and mapped source stay restricted. Project access and the member's role both apply to direct links and exports.
- Owner and Admin: manage projects, capture settings, members, policies, pricing inputs and subscription.
- Developer: inspect permitted content and source on assigned projects, with shared views and mappings.
- Viewer: inspect authorized aggregates, traces and usage metadata, without captured prompt or source access.
DSN boundary. A project DSN authenticates telemetry for that project. It is not a provider-spending credential and does not grant access to another project's data.
Retention is visible and scoped.
Current product settings target 30 days for detailed trace metadata, 7 days for captured text and 395 days for daily cost aggregates. The settings describe primary data; database-provider backup retention is separate.
- Shortening or disabling future body capture does not silently rewrite existing history.
- Expired bodies leave retained cost and metadata available, with the missing content state shown explicitly.
- Source maps are optional and release-scoped. Basic cost tracking does not require a full repository upload.
Delivery and coverage stay honest.
Telemetry delivery is asynchronous and best effort for ordinary observation. Capture or delivery errors do not become provider errors. Explicit enforcement has a separate contract and can refuse further matching calls when a supported integration cannot safely decide.
- Coverage: usage, timing, source attribution and text capture depend on the endpoint, transport and response shape. Check the published provider matrix.
- Unknown is not free: unpriced or partial calls remain visible as unknown or partial; CostKey does not substitute zero.
- Signed webhooks: generic webhook deliveries include a timestamp and HMAC signature. Secrets are not placed in notification history.
Report a security issue.
If you find a vulnerability or an unexpected data-handling behavior, email naman@costkey.dev with the smallest useful description. Please do not include credentials, tokens or customer content.