AISpendGuard

Trust & Privacy

We Never See Your Prompts

AISpendGuard is a metadata-only system. No AI content ever touches our servers. This page explains exactly what we collect, what we never collect, and how it works.

What We Collect

Each SDK call sends a single metadata event to our ingest API. The event contains only numbers, enums, and short labels — never text content.

FieldExample valueWhy it’s needed
provider"openai"Match the right pricing table
model"gpt-4o-mini"Calculate cost per token
inputTokens / outputTokens1240 / 88Cost calculation
latencyMs430Latency tracking
occurredAt"2026-03-06T10:22:00Z"Time-series grouping
feature tag"summarize"Feature-level attribution
route tag"/api/report"Route-level attribution
task_type tag"classify"Waste detection (wrong model tier)
customer_plan tag"free"Free-tier subsidy detection

Tags are short labels you define. They describe the context of an AI call, not its content. A tag is "feature=summarize", not the text being summarised.

What We Never Collect

  • Prompt text — the instructions or questions you send to the model
  • Completions — the text the model returns
  • System prompts — your proprietary instructions or personas
  • User content — anything your end users write or upload
  • Model outputs — generated code, summaries, answers, images
  • Conversation history — multi-turn context or memory
  • Embeddings — vector representations of your content

These fields are rejected at the ingest boundary if they appear in a payload. The SDK never reads or forwards prompt or completion text.

How It Works

  1. Your code calls the AI provider directly. The SDK wraps your existing OpenAI / Anthropic / Gemini call — it does not act as a proxy. Your API request goes from your server to the AI provider.
  2. After the call completes, the SDK reads only token counts, latency, model name, and the tags you provided. It does not read the prompt or completion text.
  3. A single metadata event is sent to https://aispendguard.com/api/ingest with only those fields.
  4. The event is stored in your workspace in an EU-hosted database (Neon, Frankfurt). Only your workspace members can see it.
  5. The dashboard aggregates metadata to show cost attribution, waste findings, and spend trends. No content is ever displayed because no content is ever stored.

Enforced at the API Boundary

The ingest API actively rejects payloads that include content fields. If a request contains any of the following field names, the entire batch is rejected with a 422 error:

prompt • completion • system_prompt • messages • content • input • output • text • response • user_message • assistant_message • context • document

This is a hard server-side guard — it applies regardless of SDK version or how the API is called.

Data Residency

  • Database: Neon PostgreSQL, eu-central-1 (Frankfurt, Germany)
  • Application: Vercel Edge Network, fra1 (Frankfurt, Germany)
  • Authentication: Clerk, EU-region instance
  • Payments: Stripe (PCI-DSS compliant, no card data stored by us)

All metadata stays in the EU. No data is replicated to US regions.

Verify It Yourself

The SDK is open source. You can read the source code and confirm that it only reads token counts and tags — never prompt or completion text.

View SDK source on GitHub →

Legal Documents

Questions? privacy@aispendguard.com