Security & data protection
Know how your organization’s
data is handled. Understand what is collected, when content may leave a device, and how access is controlled. Start with the essentials, then inspect the details.
Understand the boundary
Usage records and message text
follow different paths. 01 Usage metadata Tool, model, token counts and cost records help attribute organizational usage. These records are separate from message text.
02 On the device Message text is read in memory for classification. Local processing and external transfer have separate controls.
External classification · conditional External classification is on by default. Sending message text still requires a dated default or personal grant and enabled workspace, model and on-device settings. Existing individual OFF choices remain unchanged.
We configure the relay and gateway not to log message text. The model provider’s retention policy is not guaranteed by TokenMeter.
Scheduled analysis has separate requirements: an explicit member-origin transfer grant and a current member/device analysis-purpose grant. Organization collection policy, tenant defaults and administrator purpose grants do not authorize scheduled transfer.
Controls in context
Protection across the service.
Inspect the details
Security practices, without the shorthand. Read the current controls, processing responsibilities and subprocessors. The privacy notice governs if it differs from this page.
Privacy notice · 22 Oct 2026 Page revised 13 Nov 2026 · Source security page 25 Oct 2026
Daily classification and scheduled analysis have different authorization requirements. Check the conditions for each type of external transfer.
Review TokenMeter for your organization. Discuss your data requirements before you connect your team.
Ask a security question Security details (English) Overview
What we handle TokenMeter receives usage metadata such as who used which tool and model, token counts and cost. Message text is read in memory on the device for classification. External content classification is on by default, but message text is sent only when the required authorization and workspace/model settings allow it. Existing individual OFF choices remain unchanged.
Infrastructure
Hosting The application, database, gateway, backups and mail currently run on AWS in the Seoul region (ap-northeast-2). The hosting region may change in the future.
Server access Servers are not reachable over SSH from the internet; our operators reach them only through AWS Systems Manager.
Data protection
Workspace isolation Each workspace is isolated from every other by the database itself (PostgreSQL row-level security), which the service cannot bypass.
Encryption Data is encrypted in transit (HTTPS/TLS) and at rest (encrypted disks and snapshots). Provider API keys and two-factor secrets are additionally encrypted (AES-256) inside the database. To route your requests, the gateway we operate also holds a copy of provider credentials in the Seoul region.
Account security
Sign-in Passwords are stored as one-way hashes (Argon2id); accounts lock after repeated failed sign-ins; two-factor authentication (TOTP) with backup codes is available.
Roles and sessions Administrator, manager and member roles are separate. Administrators approve which devices may report, and members see and end their own sessions in Settings › Me › Sign-in security.
Internal access
Support access Named TokenMeter platform administrators can view a workspace, read-only, for support; every view is logged.
Data deletion Permanently clearing a workspace's data requires a platform administrator and is recorded.
Secure development
Change management Changes are reviewed and pass automated tests — including workspace-isolation tests against a real database — before release. Releases are built only from the reviewed main branch.
Agent releases Agent updates are cryptographically signed and verified before install; the macOS agent is notarized by Apple.
Monitoring and availability
Monitoring Our operators are alerted automatically if a server fails its health checks or stops.
Backups Server disks are backed up daily and kept for 7 days in the Seoul region.
Privacy and data handling
Roles Your workspace controls its members' usage data; we process it on your instructions.
Rights and deletion Members can request access, correction, export or erasure. When you close a workspace you choose whether its usage data is erased.
Content External content classification is on by default. Sending message text requires a dated default or personal grant. Organization collection policy does not authorize external transfer. The workspace must also enable classification and provide a model connection, and on-device content classification must be allowed. Existing individual OFF choices remain unchanged. Limited message text may pass through our servers and gateway in Seoul to the workspace-selected provider. We configure the relay and gateway not to log it; this does not certify the model provider's retention policy.
Subprocessors
Company Purpose Data Location
Amazon Web Services Hosting, database, gateway, backups, email delivery and receipt, release signing All service data Seoul, Korea (ap-northeast-2) Google Workspace (Gmail) Handling mail sent to our contact address Email you send us Google infrastructure, outside Korea Linear Tracking console support requests Support messages, name, email Linear infrastructure, outside Korea
Retention follows the privacy notice. AI providers you connect (e.g. Anthropic, OpenAI) receive requests under your own account; they are your providers, not our subprocessors.
Reporting a vulnerability
Contact Report suspected vulnerabilities to info@token-monitor.com.