Read-only by design. Your data stays yours.
PulseMeter connects to your LLM providers' billing and usage reporting APIs to watch spend, nothing more. Here is exactly what that means.
What we can see
- Aggregate spend in dollars, by day and by model
- Token counts (input, output, cached) from the billing API
- Which models and workspaces are active
- On enterprise seat plans (Claude Enterprise, ChatGPT Enterprise): per-teammate usage, cost, and activity metrics — a work email alongside token and dollar totals and activity counts (messages, sessions, commits, lines of code changed)
- On Amazon Bedrock: per-model token counts from CloudWatch and Bedrock line items from Cost Explorer, read through a role you create in your account.
What we never see
- Your prompts, responses, or any conversation content
- Your customers' data or your end-users' PII
- The ability to send requests, spend money, or change your account
Minimum-scope, read-only keys
We ask for the narrowest credential each provider offers for reading usage and cost: an Admin/usage key (or, for enterprise seat plans, an Analytics key), not a general-purpose API key. These keys can read usage and cost data but cannot send model requests or modify your account. Our onboarding walks you through creating one, step by step. For Amazon Bedrock we never take an AWS access key: you create a read-only IAM role that only PulseMeter's account can assume, with a per-workspace external ID; delete the stack to revoke.
Encrypted at rest
Every stored key is encrypted with AES-256-GCM before it touches the database. Keys are decrypted only in memory, only to call the provider's billing API, and are never returned to your browser. The UI shows a masked hint like sk-…4f2a only. Ciphertexts are versioned and tagged with the key that wrote them, so the master key can be rotated without downtime and without anyone reconnecting a provider.
Delete means delete
Disconnect a provider and the encrypted key is hard-deleted immediately, with no soft-delete and no lingering copies. Close your account and your workspace data is removed.
Least privilege, everywhere
Data is isolated per workspace with row-level security. Background sync runs with scoped service credentials and only ever writes usage and cost metric rows. We keep the surface area small on purpose.