Public Security Artifacts
This page summarizes source-observed mechanisms, unverified production targets, known gaps, and non-authoritative vendor categories for review before using hosted features.
Effective date: July 10, 2026. Security contact: rishabh@costlayers.com.
Assurance boundary: these are source-review and target-state artifacts, not production control evidence, a completed compliance report, or contractual commitments. CostLayers does not claim SOC 2, ISO 27001, HIPAA, PCI, or FedRAMP compliance.
Data Flow Summary
| Mode | Source-observed flow | Unverified boundary |
|---|---|---|
| Local audit and proof | CLI source writes audit/proof/report files under .agentspend/. | No-upload is a source intent; network and platform behavior need verification. |
| Hosted dashboard and metering | Source sends keyed state, account labels, counters, hashes, cost, quality, and proof metadata. | Raw-data avoidance and tenant isolation are production targets. |
| Hosted API mode | Provider-bound bodies, responses, authorization, and account traffic transit the gateway. | Sensitive hosted processing. Request-transient raw handling is a target pending canary evidence. |
| Response-cache opt-in | Provider response bodies may be stored for exact repeated requests. | Explicit opt-in and purge paths are source-observed; deployment, race, backup, and expiry evidence is missing. |
Unverified Retention Targets
| Data category | Target and evidence boundary |
|---|---|
| Account/access rows and usage metadata | Target: active lifetime plus no more than 180 days after inactivity. Complete age-based job not evidenced. |
| Login tokens and sessions | Source-observed logical targets: 15-minute links and 30-day sessions. Physical purge and logout evidence missing. |
| Raw API-mode routed traffic | Request-transient target unless cache opt-in is enabled. Deployment canary evidence missing. |
| Response-cache opt-in bodies | 30-day maximum target. Source pruning exists; deployed expiry and backup handling unverified. |
| Security and abuse logs | 90-day target; deployed log inventory and expiry job missing. |
| Support and security correspondence | 24-month target subject to documented exceptions; vendor evidence missing. |
| Backups for deleted hosted rows | 30-day target where controlled by CostLayers; inventory, encryption, expiry, and restore tests unknown. |
Deletion Targets
source_observed:costlayers privacy delete-localtargets identified local artifacts and reports manual cleanup. Verify the result.partial:costlayers privacy delete-hosted --yesand/engine/v1/deletetarget keyed primary rows; end-to-end receipts and operating history are missing.partial: cache-disable source paths target keyed purge; concurrency, restart, fallback, and backup tests are missing.- Manual request target: acknowledge within 2 business days and complete validated primary-store deletion within 30 days. No contractual SLA is claimed.
API Key Handling
- Use dedicated provider keys for hosted API invoice mode.
- Pass provider keys through environment variables or request headers, not committed files.
- Source intent is not to persist provider authorization after forwarding; production secret-canary and log evidence is required.
- CostLayers live keys and private dashboard URLs are bearer credentials.
costlayers dashboardhides the full URL unless--show-urlis supplied. Rotate or delete exposed keys or URLs.
Non-Authoritative Subprocessor Categories
These categories are planning disclosures, not a verified list of appointed legal entities. Names, regions, contracts, transfer terms, retention, and effective dates remain required.
| Unverified category | Expected purpose | Possible data |
|---|---|---|
| CostLayers hosted infrastructure, database, storage, logs, DNS, and TLS providers | Run the public site, hosted dashboard, API gateway, account rows, deletion endpoint, and operational logs. | Account/access data, hosted usage metadata, gateway metadata, security logs, and transient API-mode traffic. |
| npm package registry and package distribution services | Distribute the CostLayers CLI package. | Package download and registry metadata governed by those services. |
| Support email and calendar providers | Handle support, security reports, pilot scheduling, and deletion requests sent by email. | Email address, message contents, attachments, screenshots, logs, and scheduling metadata you choose to send. |
| Customer-selected model providers | Process model requests only when you route API invoice mode traffic through CostLayers to your provider account. | Prompts, provider responses, provider authorization, account traffic, and provider-side logs under your provider terms. |
Incident and Vulnerability Targets
- Report security issues to rishabh@costlayers.com.
- Unverified target: acknowledge vulnerability reports within 2 business days.
- Unverified target: triage plausible hosted customer-data reports within 1 business day.
- Unverified target: notify affected customers within 72 hours after confirmed hosted-data incidents where legally and operationally feasible.
Local Artifact Warning
Keep .agentspend/ private and ignored. Source review shows a CLI attempt to append the ignore rule and warn on failure; this is not a platform guarantee. The directory can contain sensitive local artifacts. Do not publish it or attach it to tickets without review.