Governance without shipping us your prompts.
Most spend and observability tools see everything you send. Outlay is built so the sensitive data physically can't reach us — purpose-built for teams that can't let prompts leave their environment.
What never leaves
- ✓Prompt text & model outputs. We connect read-only to your tracker and your provider's usage data — never request or response bodies.
- ✓Your API keys. Your provider key stays on your side and calls Anthropic directly.
- ✓Customer / PII data. Anything inside a prompt stays inside your boundary.
Ingestion rejects payloads carrying sensitive field names (prompts, outputs, keys) or credential-looking values (HTTP 422) — defense in depth on top of a client that only ever sends aggregates.
What we do see
To attribute spend to work, we receive a small, non-sensitive set:
- ·A task category and numeric features (token counts, flags).
- ·The ticket / branch identifier the work belongs to (e.g.
PROJ-123). - ·Per-request cost figures from your provider's usage data — dollars and counts, never content.
Architecture: read-only, and never in your traffic path
Outlay is not a proxy or gateway — your AI calls never flow through us. It connects to your tracker (Jira/Linear/GitHub) and your provider's usage/admin APIs with read-only tokens and pulls metadata: usage counts, models, and ticket references. Your prompts, model outputs, and API keys stay entirely on your side; there's nothing for us to see in your traffic because we're not in it.
Access control & sign-in security
- ·Phishing-resistant passkeys (WebAuthn / FIDO2) — Touch ID, Windows Hello, or a security key — plus authenticator (TOTP) and email codes. Admins can require MFA for everyone (owners and invited members), enforced before access.
- ·SSO via SAML / OIDC + SCIM provisioning and de-provisioning, with role-based access (owner / admin / member, least privilege).
- ·Session & account controls — configurable idle and absolute session limits, one-click "log out everywhere", account lockout on repeated failures, and password screening against known-breached lists.
- ·Encrypted at rest — connector tokens and secrets are encrypted at the application layer, so a database-file leak alone never exposes them.
- ·Full audit log → your SIEM — every privileged and authentication event (including failed logins and security-policy changes), with CSV + streaming export, plus a signed incident/breach webhook to your SOC.
Trust Center & compliance posture
In-app there's a Trust Center with your security policy, sign-in controls, and downloadable artifacts: a VPAT / ACR (WCAG 2.1 AA · Section 508), an AI model & system + data card with an Acceptable Use Policy, and the audit-log export. Our controls map to NIST 800-53 and the SOC 2 criteria.
Honest status: SOC 2 Type II is in progress (not yet held); FedRAMP / StateRAMP-GovRAMP and FIPS-validated cryptography are on the roadmap for government deployments. We never claim a certification we don't hold — ask us for current status.
Data handling, isolation & exit
- ·Per-deployment isolation — your metadata is scoped to your deployment.
- ·Configurable retention — set how long spend-history snapshots are kept (forever, or auto-purge after 30 / 90 / 180 / 365 days). Data minimization is on by your terms, not ours.
- ·Erase on demand — wipe your ingested spend data, or delete your whole account and every trace of it, yourself from Settings — no email, no waiting. (Account deletion removes all data including your encrypted connection tokens.)
- ·Leave anytime — it's your key and your traffic; removing Outlay changes nothing about how your calls are made (we were never in the path).