Security
You’re trusting us with an API key. Here’s exactly how we protect it.
Last updated: July 2026
The whole point of TokenLens is to reduce anxiety about your AI spend — so the last thing we’d do is add a new anxiety about your key. This is the plain-English version of how we keep it safe.
Your key is encrypted before it’s ever stored
When you connect a key, we encrypt it with AES-256-GCM — the same strength of encryption banks use — before it touches our database. Each key gets its own unique encryption values, so no two are stored the same way. What sits in the database is scrambled and useless without the encryption secret, which lives separately.
We only ever ask for read-only keys
TokenLens reads your usage. It never sends requests on your behalf, never spends a token, and never changes anything in your OpenAI or Anthropic account. A read-only key literally can’t be used to run up your bill.
We never show it back or write it down
- After you save a key, it’s never displayed again — not on your screen, not in our support tools.
- It’s never written to our logs. The key is decrypted only for a brief moment, on our server, during the daily sync — then discarded from memory.
- You can delete it anytime, which permanently removes it.
Everything travels over HTTPS
Every connection to TokenLens is encrypted in transit with HTTPS. Your data is never sent over an open connection.
No passwords to steal
We use one-time magic links instead of passwords. There’s no password database to breach, and nothing for you to reuse and have leaked elsewhere.
Honest about where we are
Early-stage transparency. TokenLens is a young, independently run product. We follow strong security practices — real encryption, read-only access, least-data collection — but we do notyet hold formal certifications like SOC 2. We’d rather tell you that plainly than imply otherwise. As we grow, so will the formal guarantees.
Found a problem? Tell us
If you discover a security issue, please email hello@token-lens.combefore disclosing it publicly. We’ll respond quickly and work with you. We’re grateful to anyone who helps keep TokenLens safe.