Read-only by design. Your data stays yours.
PulseMeterconnects to your LLM providers' billing APIs to watch spend, nothing more. Here is exactly what that means.
What we can see
- Aggregate spend in dollars, by day and by model
- Token counts (input, output, cached) from the billing API
- Which models and workspaces are active
What we never see
- Your prompts or completions
- Your customers' data or PII
- The ability to send requests, spend money, or change your account
Minimum-scope, read-only keys
We ask for the narrowest credential each provider offers for reading usage and cost: an Admin/usage key, not a general-purpose API key. These keys can read billing data but cannot send model requests or modify your account. Our onboarding walks you through creating one, step by step.
Encrypted at rest
Every stored key is encrypted with AES-256-GCMbefore it touches the database. Keys are decrypted only in memory, only to call the provider's billing API, and are never returned to your browser. The UI shows a masked hint like sk-…4f2a only. Our production roadmap moves key custody to a dedicated secrets vault with routine rotation.
Delete means delete
Disconnect a provider and the encrypted key is hard-deleted immediately, with no soft-delete and no lingering copies. Close your account and your workspace data is removed.
Least privilege, everywhere
Data is isolated per workspace with row-level security. Background sync runs with scoped service credentials and only ever writes aggregate usage rows. We keep the surface area small on purpose.