The honesty brand's natural flex: the exact field list, not a promise.
We sit inline on your traffic, so a privacy claim you cannot check is worth nothing. So here is the precise, body-free column list our metering path writes, lifted from the code that writes it, plus exactly how the gateway behaves when it faults. Read it, then verify it with one curl.
One body-free row per request. These columns, nothing else.
This is the whole metered record. It is metadata about the call, never the call's content. We never store prompt or response bodies, and we never train on your traffic.
What never lands in that row
- Prompt messages or system prompts
- Response or completion text
- Tool-call arguments or tool outputs
- Embedding input text
- Your provider key in plaintext (encrypted at rest; decrypted in memory per request; never logged)
- A dollar cost on the row (baseline_cost / realized_cost are always NULL here; USD is priced later at rollup)
The one scoped exception, stated up front
Quality evaluation is the only place a response body is ever reassembled, and it is opt-in. When you turn on shadow evaluation, a copy of the model output is held in memory to score non-inferiority off the hot path. It is never written to the metering row above, and it is off by default. We would rather name our own exception than have you find it.
Your provider key is encrypted at rest (AES-256-GCM), decrypted only in memory for the lifetime of one request, and never logged or written to the database.
If we are down or slow, your request goes straight to your provider.
A fault in any Recovea-added optimization or metering layer never becomes your 5xx. The request falls through to your provider, on your own key, on the baseline model. We publish no uptime percentage and no SLA. This is an architectural property, not a number we ask you to trust.
Said in the same breath: fail-open does not unbuckle your seatbelt
The layers that ADD value (optimization, metering) fail open. The layers that PROTECT you (auth, tenant isolation, your spend cap) fail closed. You cannot trigger a fault to make your cap evaporate: an unconfirmable cap blocks rather than leaks, and auth refuses rather than serves. Visibility may briefly gap during an outage; enforcement does not. Every fall-through increments an internal counter (gateway_fail_open_total) that pages us, so we watch our own fallbacks instead of hoping they are rare.
Three things on this page are falsifiable, not asserted.
The columns above are the whole metering row. Run a call, request a copy of what we recorded for it by its x-request-id, and you will get back exactly these fields and no body.
Every billed request returns a recovea-receipt-v1 you can re-derive yourself, client-side, with no server trust, hash-chained into the ledger as recovea-chain-v1.
Confirm the endpoint is live and that switching is a one-line base_url change you can revert instantly, with no account. Run the curl quickstart.
On the roadmap, not shipped, and we will not pretend otherwise
- PlannedSelf-host in your own VPC, where payloads never leave your network. Planned for the enterprise roadmap, not available today.
- PlannedPer-tenant KMS envelope encryption with a customer-supplied key that revokes our access. Planned; today the key is encrypted at rest in our secrets store.
- PlannedAn open-source receipt verifier so you can re-derive a receipt with our code, not just our word. Planned.
- PlannedSOC 2 is on the roadmap. We are not certified yet and we say so.
Security contact and disclosure policy: /.well-known/security.txt. The broader posture lives on Security & trust.
Read the field list. Run the curl. Then decide.
No prompt bodies stored, no training on your traffic, fail-open by design, and a spend cap that fails closed. All of it checkable.