01 / Stored
Billing evidence only.
Usage
- Project, environment, customer, and retry IDs
- Provider, requested model, reported model, and provider request ID
- Input, cached, and output token counts
- Available cost, price source, latency, and response status
- Safe trace IDs and safe tool names
Billing
- Customer billing identity and optional Stripe customer ID
- Versioned pricing rules and exact model rate cards
- Fixed billing-run totals and source-call IDs
- Encrypted Stripe restricted key and webhook secret
02 / Excluded
Never written to the product database.
Provider secrets
API keys and authorization headers pass through process memory for the request and are not stored.
Request content
Prompts, messages, response bodies, tool arguments, and payloads are not stored.
03 / Controls
V1 protection and correctness.
- Sensitive database functions require a server-only authorization token; direct browser calls are rejected.
- Separate rotatable test and live write keys; only hashes remain after creation.
- A retry ID is reserved before provider spend. A keyed one-way fingerprint covers the prepared request without storing its content, so changed payloads become conflicts.
- Customer IDs are limited to 1–80 safe characters, and provider responses above 4 MiB are rejected.
- Provider origins and request paths are fixed in code; arbitrary upstream URLs are rejected.
- Stripe secrets use AES-256-GCM encryption with project-specific context before storage.
- Stripe webhook signatures are checked against the raw request body.
- Protected dashboard routes use signed, HTTP-only, project-scoped cookies with SameSite Strict; dashboard mutations also require the exact site origin.
04 / Observability
Traffic and errors without product secrets.
Traffic
Vercel Web Analytics records basic page traffic. Amplitude can record page views, sessions, web performance, and named activation events when configured.
Blocked data
Automatic form, element, file-download, and network capture are disabled. Email addresses, form contents, project IDs, request bodies, prompts, responses, API keys, write keys, recovery codes, cookies, and authorization headers are not sent as analytics properties.
Errors
Sentry can receive browser and server errors when configured. Request bodies, headers, cookies, query strings, user data, extra fields, and known secret formats are removed before an error leaves Tollgate.
05 / Current boundary
Private beta, not enterprise compliance.
Tollgate has not completed SOC 2 or an external penetration test. Recovery-code access is for the private beta. Team roles, single sign-on, audit-log export, regional data controls, and formal retention/deletion workflows are not available yet.