Here’s what we do and what we don’t.
This page is written plainly — today and roadmap, split clearly, nothing overstated. If you need something that isn’t here, ask. We’ll tell you honestly whether we can ship it on your timeline.
What data we read
AICosts.ai reads billing and usage data from the AI providers you explicitly connect. We do not sit in your inference path, we do not read prompt or completion contents, and we do not receive end-user PII from your application.
- Account metadata: email, name, role.
- Provider API keys (encrypted at rest — see below for algorithm).
- Usage records: per-day, per-platform, per-model costs and counts, with per-item breakdowns for units the provider bills on (tokens, operations, characters, etc.).
- Billing files you upload for platforms without an API (parsed using OpenAI on a standard commercial API tier — no zero-retention agreement yet; on the roadmap).
Encryption
Provider API keys are encrypted server-side with AES-256-CBC using a single server-side key held in the application environment, and a per-record random IV. TLS 1.2+ is enforced on the public web and API. Databases use the at-rest encryption provided by MongoDB Atlas. Backups inherit the same. We do not currently use envelope encryption, KMS, per-tenant keys, or field-level DEKs — those are on the roadmap.
Authentication
Email + password (bcrypt hashing) with optional TOTP 2FA and backup codes. JWT sessions. We do not currently offer SAML, OIDC, or SCIM — those are on the roadmap.
Authorization
Today each account is a single user with their own API keys and usage data. We do not yet offer organizations, workspaces, role-based access control, or shared accounts. Those are on the roadmap; until they ship, we don't market them.
Logging
Application request logs are written via morgan and retained according to the hosting provider's defaults. A structured application-level audit log (actor / action / target / IP / timestamp) exists as an internal schema but is not yet wired into routes or exposed to customers. That wiring is on the roadmap.
Data residency
All customer data is processed and stored in a single US region (MongoDB Atlas US, AWS us-east-1). We do not currently offer EU-region residency, data export to customer-controlled storage, or deletion on a defined SLA beyond manual request. Those are on the roadmap.
Subprocessors
Today: AWS (hosting and S3), MongoDB Atlas (database), Vercel (landing page), Stripe (payments), SendGrid (email), OpenAI (parsing uploaded billing files for Professional tier), Mixpanel (web analytics), GitHub (source control), Product Hunt / Vercel Analytics (web tracking). No others are in active use. See SUBPROCESSORS.md in the repo for the current list.
Incident response
We aim to triage security issues within 24 hours of being reported and to notify affected customers within 72 hours of confirming a material incident. We do not currently publish a status page, and we do not have a formal bug bounty program. Report vulnerabilities to security@aicosts.ai.
Not shipping yet — roadmap, not commitments
These are things we plan to build, in rough order. Dates are targets that depend on which enterprise customers pilot and prioritize them. None of the items below exist in the product today, and none are being sold as if they do.
- SAML / OIDC SSO and SCIM provisioning (via an identity broker — we have not yet signed with one).
- Organizations, workspaces, and role-based access control (Owner, Admin, Member).
- Audit log wired to every admin-level event, retained 12 months, exportable.
- Per-tenant encryption keys with KMS envelope (today is a single app-level key).
- Automated key rotation.
- SOC 2 Type I engagement. We have not yet engaged an auditor or a compliance-automation partner.
- Signed DPA and MSA templates (attorney-reviewed).
- Pre-filled SIG-Lite / CAIQ-Lite responses.
- Zero-retention agreement with OpenAI for the billing-file parser.
- EU-region data residency.
- Public status page at status.aicosts.ai.
- Annual third-party penetration test.
Last updated: 2026-04-17.
If something here is still wrong or unclear, that’s on us — email security@aicosts.ai and we’ll fix the page.