Metadata by default
By default we ingest event metadata only: provider, model, feature, token counts, cost, latency, status, and the tags you attach (tenantId, userId, feature, run, agent). That is enough for attribution, margin, and real savings. Raw prompt and output text is never ingested unless you explicitly turn capture on.
Prompts stay opt-in
Prompt and output capture is off by default and used only for the optional Cost-Validated Savings replay feature. When a workspace owner turns it on, sampled content carries a 14-day TTL and a daily job deletes it on expiry. Opt back out and captured samples are deleted immediately, not at the end of the window. Event metadata retention follows your plan (7, 14, 30, or 90 days).
Never in your request path
The hosted trAIce service is not a gateway. Usage events are sent after your LLM call returns, so a trAIce issue cannot slow your calls or take them offline. The only optional in-path action is an exact-response cache that runs locally inside the SDK and fails open to your provider on any error. Local SDK overhead per tracked call stayed under 1 ms at p99 across our Node.js and Python benchmark matrix. That figure is evidence, not a latency SLO, and excludes provider latency, network delivery, and opt-in checks. See the runtime performance benchmark.
Keys and encryption
Your trAIce API keys are stored as SHA-256 hashes; the raw key is never persisted, and only a short prefix is shown for identification. Provider keys you connect for replay are encrypted at rest with AES-256-GCM, and only a masked identifier is returned to you. Data is encrypted in transit with TLS, and we follow least-privilege access for our subprocessors.
Subprocessors and certification
Our subprocessors and processing terms are listed in the Data Processing Addendum. We are not yet SOC 2 certified, and we would rather say so plainly than dress it up. SOC 2 Type I is on our near-term roadmap, with Type II to follow once we have the observation window behind us. Security is already built into how the product works: not in your request path, prompts off by default, encrypted keys. You can request a written security questionnaire, and we are happy to walk your security team through our controls directly.
Your controls
You can export your account dataset and schedule workspace deletion from Settings, and toggle prompt capture on or off at any time. Full detail on collection, retention, and your rights is in the Privacy Policy.