The short version: read-only keys, AES-256 at rest, export or delete everything, anytime. The long version follows, in plain English.
Connections use read-only or admin-usage keys: Anthropic Admin keys read usage and cost reports; OpenAI Admin keys cannot call inference endpoints at all; OpenRouter management keys cannot spend credits; Stripe restricted keys carry Read on Customers, Subscriptions and Invoices — never write, never payment methods. TokenLedger can never read your prompts, your data, or your files, because the keys you paste are not capable of it.
Provider keys and Slack webhook URLs are encrypted with AES-256-GCM under a 32-byte key held only in the server environment, with a fresh initialisation vector per record. Decryption happens server-side at sync time only. The client is shown a masked form (sk-ant-…4f2a) and nothing more. A redaction layer strips anything key-shaped from logs before they are written.
Every product route and mutation checks a signed session and workspace membership on every query — workspace identity always derives from the server-validated membership, never from client input alone. Auth is passwordless: magic links and GitHub OAuth. Auth endpoints and key-validation are rate limited; responses carry strict security headers including CSP, HSTS and frame denial.
The full cost-event export is one click on every plan. Deleting a workspace requires a typed confirmation and hard-deletes every row and key within 24 hours, confirmed in writing. Deleted connections destroy their stored keys immediately; retained events are labelled and purge with the workspace. Read the detail in the privacy policy.
Four, each doing one job:
Found something? Email security@tokenledger.app with details. Honest reports get honest answers, fast.