The things worth asking before you connect.

They are stored so the detectors can read them — reconstructing your call sites and measuring prompt bloat is not possible from token counts alone — and they are used for nothing else. Nothing you connect trains a model. API credentials are encrypted at rest; reports live at long, unguessable URLs.

What actually appears on a report is an allowlist, not a dump: dollar figures, token counts, a short abbreviated prompt signature per call site, and replay excerpts cut off at 300 characters. Anything a detector attaches that is not on that list is dropped before the page renders it.

Replay is the only thing that re-sends your text anywhere, and it is off until you switch it on for the workspace. When it is on, we replay a sample — never more than 50 calls per finding, under a hard token budget for the whole run — through our AI gateway.

No. You either paste a read-only usage API key or upload a trace export you already produce. There is nothing to install, nothing to wrap, and nothing of ours in your request path — so nothing we do can add latency to a production call or fail one.

Code changes only ever come at the end, from you: each finding tells you which call site to touch and what to change. Acting on it is optional and entirely on your side of the line.

For findings that recommend a different model, we take a sample of your real calls, re-run them unchanged on the cheaper model, and hand each pair to an independent judge that scores whether the new answer could be substituted in production without anyone noticing.

A finding is only marked measured if it clears a mean score of 90 across at least five samples — and if those samples cover at least 60% of the calls we sampled for it. That second condition is the one that stops five good scores out of fifty sampled calls reading as proof: whatever removed the other forty-five is rarely independent of how hard they were. Score badly enough and we do not caveat the finding — we drop it from the report entirely. Everything else stays labelled estimated, and you can read every scored pair yourself.

See the evidence on the example report →

Then you get the spend side of the audit in full: real dollars by model, the shape of your consumption over the window, and findings where the aggregate data supports one — a premium model carrying volume that a cheaper one in the same family could take, for instance.

What you will not get is anything that needs the prompt text: no prompt-bloat or caching findings, and no replay verification, because there is nothing to replay. Those findings are labelled estimated and say so plainly. The example report deliberately includes one of these alongside the trace-backed findings so you can see the difference before you connect anything.

Then the report says so, in as many words, and you have spent nothing to learn it — the first audit is free, and the total recoverable figure is on the free tier rather than behind the paywall. A workspace with no recoverable waste is an unusual result, and a genuinely useful one to be able to show a finance team.