Security
Last updated 2026-10-25 · Where this page and the privacy notice differ, the privacy notice governs.
- Hosting
- AWS Seoul region (current)
- Isolation
- Database row-level security
- Encryption
- TLS in transit · encrypted at rest
- Sign-in
- Two-factor (TOTP) available
- Backups
- Daily · kept 7 days
- Internal access
- Read-only · every view logged
Overview
What we handle
TokenMeter receives usage metadata such as who used which tool and model, token counts and cost. Message text is read in memory on the device for classification. External content classification is on by default, but message text is sent only when the required authorization and workspace/model settings allow it. Existing individual OFF choices remain unchanged.
Infrastructure
Hosting
The application, database, gateway, backups and mail currently run on AWS in the Seoul region (ap-northeast-2). The hosting region may change in the future.
Server access
Servers are not reachable over SSH from the internet; our operators reach them only through AWS Systems Manager.
Data protection
Workspace isolation
Each workspace is isolated from every other by the database itself (PostgreSQL row-level security), which the service cannot bypass.
Encryption
Data is encrypted in transit (HTTPS/TLS) and at rest (encrypted disks and snapshots). Provider API keys and two-factor secrets are additionally encrypted (AES-256) inside the database. To route your requests, the gateway we operate also holds a copy of provider credentials in the Seoul region.
Account security
Sign-in
Passwords are stored as one-way hashes (Argon2id); accounts lock after repeated failed sign-ins; two-factor authentication (TOTP) with backup codes is available.
Roles and sessions
Administrator, manager and member roles are separate. Administrators approve which devices may report, and members see and end their own sessions in Settings › Me › Sign-in security.
Internal access
Support access
Named TokenMeter platform administrators can view a workspace, read-only, for support; every view is logged.
Data deletion
Permanently clearing a workspace's data requires a platform administrator and is recorded.
Secure development
Change management
Changes are reviewed and pass automated tests — including workspace-isolation tests against a real database — before release. Releases are built only from the reviewed main branch.
Agent releases
Agent updates are cryptographically signed and verified before install; the macOS agent is notarized by Apple.
Monitoring and availability
Monitoring
Our operators are alerted automatically if a server fails its health checks or stops.
Backups
Server disks are backed up daily and kept for 7 days in the Seoul region.
Privacy and data handling
Roles
Your workspace controls its members' usage data; we process it on your instructions.
Rights and deletion
Members can request access, correction, export or erasure. When you close a workspace you choose whether its usage data is erased.
Content
External content classification is on by default. Sending message text requires a dated default or personal grant, or separately applicable organization-policy authority. The workspace must also enable classification and provide a model connection, and on-device content classification must be allowed. Existing individual OFF choices remain unchanged. Limited message text may pass through our servers and gateway in Seoul to the workspace-selected provider. We configure the relay and gateway not to log it; this does not certify the model provider's retention policy.
Subprocessors
| Company | Purpose | Data | Location |
|---|---|---|---|
| Amazon Web Services | Hosting, database, gateway, backups, email delivery and receipt, release signing | All service data | Seoul, Korea (ap-northeast-2) |
| Google Workspace (Gmail) | Handling mail sent to our contact address | Email you send us | Google infrastructure, outside Korea |
| Linear | Tracking console support requests | Support messages, name, email | Linear infrastructure, outside Korea |
Retention follows the privacy notice. AI providers you connect (e.g. Anthropic, OpenAI) receive requests under your own account; they are your providers, not our subprocessors.
Reporting a vulnerability
Contact
Report suspected vulnerabilities to info@token-monitor.com.