Security & your data
Last updated June 18, 2026
spendguard touches money and (optionally) prompts, so trust is the product. Here's exactly what we hold, what we never hold, and how it's protected — in one place, not buried in a policy.
What we store vs. never store
| We store | We never store |
|---|---|
| Per-day spend roll-ups (totals by provider / model / project / contributor) | Your provider API keys or any secret |
| Scrubbed, generalizable cost/efficiency abstracts | Raw prompts, completions, or per-call data |
| Leak / coverage aggregates | Spend tied to a person beyond their visibility tier |
| Identity (Clerk) & subscription state (Stripe) | Any other organization's data |
How it's enforced
- Your keys never leave your machine. We never proxy or resell tokens — your model calls run on your own provider accounts.
- Scrubbed at the source. The open-source client sends abstracts only;
visibility=privatesends nothing. - Denylist on ingest. The server rejects (422) any payload with prompt-like, key-like, or PII content.
- Tenant isolation. Postgres row-level security means a query physically cannot cross organizations.
- In transit & at rest. TLS everywhere; encryption at rest; ingest keys stored hashed; signed, idempotent webhooks; a least-privilege app database role; rate-limited APIs.
- Open client. The client is open source (MIT) — you can audit exactly what leaves your machine.
Export & delete
Your data is yours. Export it any time, and an org owner can permanently purge the organization's data from the dashboard — we email a confirmation link to your verified address, then the deletion cascades across every table. Or email privacy@llmspendguard.com.
See also: Privacy Policy · DPA · Subprocessors.
Ensight.ai · 204 2nd Ave, #204, San Mateo, CA 94401 · privacy@llmspendguard.com (privacy) · support@llmspendguard.com (support)
Privacy · Terms · DPA · Subprocessors