UsageTap handles the usage and cost signals behind AI products. This page explains what we collect, how we protect it, who helps us operate the service, and where our security program stands today.
01
Collect deliberately
Meter is metadata-first. Content processing belongs to explicit features.
02
Limit access
Identity, organization membership, and least-privilege service roles gate data.
03
Explain the gaps
We state what is certified, what is not, and whose assurance applies.
Data boundaries
We do not describe every UsageTap feature as “metadata-only” when that is not true. Meter, Compress, and Gateway have different jobs and therefore different processing boundaries.
Meter records the commercial and operational facts needed to understand usage, enforce plans, and calculate cost.
Compress must receive the content selected for compression, review, or quality evaluation in order to return a result.
Gateway receives model requests so it can enforce usage policy, route them, and return the provider response.
Security controls
These controls are implemented in our current AWS architecture. They are not a claim of independent certification.
Shared responsibility matters
AWS secures the underlying cloud. UsageTap remains responsible for how we configure, operate, and secure the application built on it.
Dashboard access is tied to server-managed organization memberships. Short-lived identity claims and server-side checks keep one customer from requesting another customer's records.
Customer data is encrypted in transit and at rest on AWS. Sensitive integration credentials use AWS Secrets Manager and dedicated, rotating AWS KMS keys.
API keys and provider credentials are redacted after saving and made available only to the backend functions that need them. Public and embedded sessions use short-lived signed tokens.
Meter is designed for usage metadata, not prompt or response content. Features that must process content, such as Compress or Gateway, make that boundary explicit.
AWS CloudWatch metrics, logs, dashboards, and alarms help us identify failures and unusual operating conditions. Production function logs have a defined retention period.
Production stateful resources use retention safeguards and point-in-time recovery where supported. Critical background work uses encrypted queues, retry controls, and failure alarms.
Service providers
We rely on specialized providers instead of attempting to build cloud infrastructure, payment processing, analytics, or consent management from scratch.
Primary cloud infrastructure
Hosts our application, identity, APIs, databases, object storage, email delivery, encryption, and operational monitoring.
AWS SOC 1, SOC 2, and SOC 3 informationUsageTap subscription billing
Runs our hosted checkout and customer billing flows. Stripe handles payment card details; UsageTap does not store full card numbers.
Stripe security and complianceProduct and website analytics
Helps us understand product adoption and website performance so we can improve the experience and diagnose issues.
PostHog Trust CenterConsent and legal policy tooling
Powers our cookie consent controls and the published Privacy Policy and Terms of Service experiences.
Termly compliance and securityFeature-dependent providers
OpenAI, Anthropic, Google, or OpenRouter when selected for Gateway or model-powered processing.
Stripe for customer billing synchronization and Slack for alerts, only when an organization connects them.
Compliance roadmap
For an early, founder-led company, the honest answer is more useful than a wall of grey badges.
Now
Document current controls, data boundaries, providers, legal documents, and known gaps in one place.
Next
Turn implemented safeguards into owned policies, recurring evidence, access reviews, incident procedures, and vendor reviews.
Later
Pursue independent certification when customer requirements and company maturity make the scope and investment appropriate.
Policies and requests
This page is a plain-language overview. Our Privacy Policy explains data practices in legal detail, and our Terms of Service govern use of UsageTap.
What we collect, why we process it, how it may be shared, and the choices available to you.
Read the Privacy PolicyThe rights and responsibilities that apply when you access and use UsageTap.
Read the Terms of ServiceNeed to complete due diligence, report a concern, or ask about a data request? Talk directly with us.
Contact the foundersA question we have not answered?