Security
We only read your usage. Your prompts stay yours.
Reads usage only
Only reads usage
OpenAI and Anthropic need an admin key for usage and cost reports. Tilwe only uses it to read those.
Encrypted at rest
Keys are encrypted with AES-GCM before they touch the database.
No prompt storage
The gateway records tokens, cost, customer and feature. Never the text.
Do you see my prompts?
No. We store usage numbers only.
Can I delete my key?
Yes, any time. Or turn on One-time audit and we delete it right after the import.
Are you SOC 2 certified?
Not yet. We will say so here when we are.
What Tilwe stores
We store usage details, never your prompts.
- Usage and cost numbers from your OpenAI and Anthropic usage and cost reports.
- For requests through the gateway: tokens, cost, customer and feature.
- Your provider admin key, encrypted with AES-GCM before it touches the database.
What Tilwe never stores
- The text of your prompts. The gateway records the numbers above, never the text.
Security documents
- security.md: This page as plain text, with our vulnerability disclosure policy.
- security.txt: Where to report a security problem (RFC 9116).
Security questions or a report: email team@tilwe.com with "Security" in the subject.
Find out where your AI money goes.
Leave your email. We reply within one business day.