How we protect your data

Provider API keys (your OpenAI / Anthropic / Google / etc keys) are encrypted at rest with AES-256-GCM. The encryption key lives only in environment variables — a database dump alone is unreadable without it.

Per-user envelope encryption for stored prompts + responses on paid tiers. Each user gets a unique key derived from the master key + their user_id via HMAC-SHA256. A compromise of one user's data does not affect anyone else.

Zero Data Retention (ZDR) option on every account: prompts + response bodies are dropped at insert time. Cost / token / model metadata still flows so the dashboard works; the bodies themselves are never stored. Configurable from Settings.

PII redaction (storage-side, opt-in): regex-based masking of emails, phone numbers, US SSNs, Luhn-validated credit card numbers, and IPv4 addresses before insert. Upstream providers still receive the original payload — this is a guard against DB dumps, not a content filter.

Slack webhook URLs for the weekly digest are encrypted with the same AES-256-GCM envelope. The API never returns the plaintext URL — even to the account owner; you replace it but can't read it back.

Configurable retention: 7-day, 30-day, 90-day, 1-year, or forever per account. A nightly cleanup job purges anything past its expiry plus a hard 30-day floor on rows marked "forever" (operational guard against unbounded JSONB growth).

TLS everywhere. api.trackcost.ai + www.trackcost.ai are HSTS-preload-eligible.

Standard hardening headers on every response: CSP, X-Frame-Options, Referrer-Policy, X-Content-Type-Options, Cross-Origin-Opener-Policy, Cross-Origin-Resource-Policy.

CORS allowlist limited to trackcost.ai origins for the dashboard. Programmatic API access (proxy + dashboard endpoints) uses Bearer-token auth.

Passwords are bcrypt-hashed (cost factor 12). Plaintext passwords never touch disk or logs.

OAuth (Google + GitHub) uses the standard Authorization Code flow with a signed-JWT state nonce (CSRF defense). Refuses silent account-linking when an existing local account has a password — prevents the takeover where an attacker pre-registers a victim's email then waits for the victim to sign in with OAuth.

Session tokens are short-lived JWTs (7 days). OAuth callback no longer puts the JWT in the URL: the backend stores it under a single-use exchange code (60s Redis TTL, GETDEL-consumed), and the frontend trades the code for the token in a POST body.

API keys are 32-byte random tokens prefixed acl_ and stored only as SHA-256 hashes. The raw value is shown exactly once at creation.

Rate limiting on every auth endpoint: 5 registrations/hr per IP, 10 logins/min, 5 password resets/hr. Atomic Redis INCR + PEXPIRE NX.

Audit log for security-significant actions: privacy settings changed, OAuth registrations + logins, billing tier changes.

An automated test suite covers the highest-risk pure code paths — encryption round-trips, payment-webhook signature verification (HMAC-SHA256, replay window, timing-safe compare), the Slack-webhook allowlist guard, the SSRF base_url validator, and the PII redaction patterns. Tests run on every push and pull request via GitHub Actions.

Error reporting via Sentry on the backend. Uptime monitored externally. Production refuses to start without REDIS_URL — multi-instance correctness is a boot prerequisite, not an afterthought.