Privacy & data
The short version: the gateway runs in your network, and no prompt or completion text is recorded anywhere — there is no field for it.
Where your data is
decost is a binary you run, not a service you send traffic to. The gateway sits in your own network, holds your own provider keys, and writes its spend log to your own disk. It connects outbound to Anthropic or OpenAI — and, if you configure single sign-on, to your own identity provider. Nothing of ours is in that path, which is also why the sub-processor list for it is empty.
We see your traffic in exactly one case: you ask us to. A spend audit runs against an Anthropic Admin API key you supply, and its output is a report. Everything else we hold about you is a contract, an invoice, a signed savings act, and whatever you attach to a support request.
What the product records
One line per request, and the line has no field for message content: not the prompt, not the completion, not the system prompt, not tool definitions, not tool results, not file names, not file contents. The request body is forwarded byte-for-byte and never re-serialised — a property the provider's prompt cache requires, and privacy inherits.
What a line does carry:
| Group | Fields |
|---|---|
| Identity | the developer and team labels you wrote in your own config, and a SHA-256 of the virtual key |
| Attribution | session, agent, parent-agent, subagent type and turn identifiers, copied from the harness's own headers |
| Request | provider, endpoint, model asked for, model used, which policies touched it |
| Usage and money | token counts, cache reads and writes, service tier, cost in dollars |
| Outcome | HTTP status, an error class name, duration and time to first byte |
Repository and branch are not in that record. They appear only when you point the measurement engine at a harness's local logs on a machine — an explicit flag, one run at a time — and then it reads usage, ids, the git branch and the working directory from transcripts the harness already wrote. Not message text, not tool calls, not files.
Nothing is used to train a model, ours or anyone's. There is no phone-home, no usage beacon and no update check: neither binary knows an address of ours.
How long it is kept
The spend log is yours and lives on your disk; we recommend 13 months, which is the shortest period that still lets you recompute a quarterly true-up and compare a month against the same month a year earlier. Administrative audit lines keep pace with it. Control-plane sessions expire in seven days. A savings act is an invoicing record and is kept for seven years — it is one page with one amount, a period and a checksum, and names no individual.
Deleting one developer's rows is a filter over an append-only log, and we will walk your platform team through it. One consequence is worth saying out loud: removing rows changes any figure recomputed from the log afterwards. A signed act stays valid on its own terms and stops being reproducible from the log. That is a consequence of erasure, not a reason to refuse it.
This website
No cookies, no consent banner, nothing to consent to. Page counts come from a GoatCounter instance we host ourselves at stats.decost.dev — cookie-less, with no cross-site identifier and no third-party analytics service involved. There is no session replay, no chat widget, no tag manager and no ad pixel.
The site is served from Cloudflare, which sees requests as any CDN does. The audit form asks for one thing, a work email address, and posts it to Formspree; we keep it for 24 months or until you ask us to delete it, whichever comes first. Theslopmeter download is Cloudflare R2. Our source and releases are on GitHub.
Asking us something
Access, correction or deletion of anything we hold about you, the full data-processing pack — what is recorded field by field, retention, sub-processors, and a DPA your counsel can mark up — or a security report: use the form and say which. It reaches a person, not a sequence.
If you are reviewing us as a vendor, ask for the pack before the demo. It is four pages and every claim in it names the file in our source it comes from, so your reviewer can check rather than believe.