Data handling
We meter the meter, not the meaning. Caps and budgets need token counts and loop detection needs fingerprints. Neither needs to read or keep your text, so we don't.
What passes through, and what is stored
| Data | In transit | Stored |
|---|---|---|
| Prompt and response content | Yes: forwarded over TLS to the AI provider serving your request | Never. Not in the database, not in logs |
| Token counts, model, provider, cost | — | Yes: this is the usage ledger |
| Latency, HTTP status, error type | — | Yes, per request |
Task and agent attribution (X-Agent-Task-Id, the OpenAI user field, Anthropic's metadata.user_id) | — | Yes. Short opaque ids (letters, digits, _ - : .) are stored as sent. Anything that could be personal data, such as an email or free text, is stored only as a keyed hash |
Agent run ids (X-Agent-Run-Id, Claude Code's session id, or your task id) and the optional run label you send | — | Yes. Ids are stored like task ids (opaque ids as sent, anything else only as a keyed hash), with each run's spend, budget, step count and status. The label is your data: in your export, deleted with your account |
| Prompt fingerprint (a 64-bit hash, for runaway-loop detection) | — | Per agent key: in memory only, for 5 minutes. For requests in a run: two keyed 64-bit hashes (of the last turn and of the last tool calls) stored on that request's usage row and deleted with it. Not reversible to text |
| Your provider API keys | Once when it is saved, by you or by support at your request (and when you press Check): sent to that provider's free model-list endpoint to confirm it works | AES-256-GCM encrypted; never displayed after saving (the dashboard shows only its last 4 characters and dates); deleted when you remove them |
| Your AgentBursar keys (agent keys and company key) | — | A SHA-256 hash only; the key itself is shown once, when it's created or rotated |
| Dashboard login session | — | A hash of a random session token, expiring after 24 hours and deleted on logout; the cookie never holds your key |
| Account activity (who changed which setting, when, and the values before and after) | — | Yes, one row per change you or support make to agents, caps, alerts, provider keys, the webhook or your account's status (a suspension by support, with its reason). Never a key: agents by name and display prefix, provider keys by last 4, the webhook by its host only |
How long we keep data
| Data | Kept for |
|---|---|
| Usage ledger (one row per request: tokens, cost, model, status) | 400 days, then deleted automatically |
| Alerts and runaway-detection events (what the dashboard's Alerts list shows), and the record of which cap alerts were already sent | 90 days, then deleted automatically |
| Dashboard login sessions | 24 hours; removed on logout or expiry |
| Account activity | 400 days, then deleted automatically |
| Agent runs (spend, budget, status, label) | As long as the usage ledger (400 days after the run ends) |
| Prompt fingerprints | 5 minutes in memory; for requests in a run, as long as their usage row |
| Your account, agents and keys | Until you ask us to delete your account |
Your data: export and deletion
- Export: in your dashboard, Settings → Download my data gives you everything we hold about your account as a JSON file, at any time.
- Deletion: Settings → Request account deletion, or email support@agentbursar.com. We delete your account within 30 days: agent keys, provider keys, alerts, account activity and sessions are erased, and your usage history is anonymized (no longer linked to you) and then deleted on the normal schedule above.
Cookies
We use only the cookies needed to keep you logged in. No analytics, advertising or third-party cookies, and our pages load nothing from other sites, so there is no consent banner.
| Cookie | Purpose | Lifetime |
|---|---|---|
acb_client_session | Keeps you logged in to your dashboard. Holds a random session id, never your key | 24 hours, or until you log out |
acb_admin_token | Our own support staff's admin login. Never set for customers | 12 hours |
Where your content goes
- Your own provider keys: your prompt goes only to the provider of the model you name (OpenAI, Anthropic, Google, Groq or xAI), with your key, under your own account and that provider's data terms. We never send your traffic through provider accounts of ours: AgentBursar no longer resells provider capacity. (Accounts opened on our former managed plan, which used our provider accounts, keep working until they are moved to their own keys.)
- Fallback: if a provider fails, a request can be served by an equivalent model from another provider you hold a key for. Turn this off per request with the header
X-Broker-Fallback: off. - Anthropic format (
/v1/messages, used by Claude Code): your request goes only to Anthropic, byte for byte as you sent it (except the model name, if a budget downgrade you set up applies), and is never served by another provider.
The one nuance: automatic model choice
Requests that name a model, the default, are never classified: they go straight to that model's provider. Only if you send model: "auto" does a small classifier pick the model, by sending the prompt to a classification model (gpt-4o-mini) solely to choose a route. This uses your own key for the classifier's provider, or runs inside the gateway if you have none; never an account of ours. Requests that fail authentication or hit a rate limit are never classified. To avoid classification entirely, name the model you want, or pick the route yourself with the header X-Broker-Intent (code, creative, reasoning or general).
What we will never do
- Store or log prompt or response content
- Train anything on your traffic
- Share your usage data with anyone but you
- Use your provider keys for any traffic that isn't yours
Questions
Email support@agentbursar.com. This page describes how the service works technically; our privacy policy and terms of service are being finalized.