How we protect your admin keys

Provider keys (admin keys, management keys and service account keys) can read your billing data, so we treat them like passwords.

1. Encrypted before storage. Keys are encrypted with AES-128 + HMAC (Fernet) using a secret held only in our server environment, never in the database. A database leak alone doesn't reveal keys.
2. Write-only. After you save a key it's never sent back to any browser, including yours. We only show the last 4 characters so you can tell keys apart.
3. Used for one thing. The server only uses keys to call the providers' cost-report endpoints. It never creates, changes or deletes anything in your provider account.
4. No browsing by staff. Our admin page shows totals only (number of users, signups, revenue). There's no screen to view anyone's keys or spending.
5. Two-factor required. Every account must use an authenticator app before connecting a provider.
6. Delete any time. Removing a connection deletes the encrypted key. Deleting your account deletes everything.

Good practice: create a separate key just for AI Spend Tracker, so you can revoke it on its own at any time from your provider's console.