Security

1. Bring your own keys (BYOK)

CosTruss operates on a bring-your-own-keys model. You connect your own OpenAI or Anthropic account using your own API credentials. CosTruss never sits in the path of your API calls, adds no markup to your AI provider costs, and is not a party to your agreement with your provider. Your AI provider bills you directly for usage — CosTruss only reads your usage and cost data on your behalf.

2. How your API keys are stored

Your provider API keys are stored in a dedicated, separate data entity called ProviderCredential. This entity is protected by deny-all row-level security (RLS): no application user — not even you — can read, create, update, or delete these records through any frontend query. The deny-all policy means the credentials are invisible to every app-user request, regardless of role.

Credentials are only ever accessed by backend service-role functions, which bypass RLS in a controlled, server-side context to verify and use your key — never to return it. No backend function ever returns your raw API key in any response, and keys are never written to your browser's local storage.

3. Keys are never exposed or logged in full

Your raw API key is never sent to the frontend. When a key must be referenced in a log or error message, it is masked to its last four characters only. This ensures that even in diagnostic output, your full credential is never written to any log.

4. Disconnect anytime

You can disconnect any provider at any time from your settings. Disconnecting immediately stops all syncing for that provider and purges the stored credential from the ProviderCredential entity. You remain in full control of which providers are connected and for how long.

5. Your responsibility

You are responsible for safeguarding your API keys and for all usage incurred under your AI provider accounts. CosTruss provides monitoring and alerts as a tool, not a guarantee — you remain fully responsible for your own AI provider account and spend. Please rotate any key you believe may have been compromised, directly with your provider.

6. Contact

Questions about security? Email costruss.team@gmail.com.