Manifesto

A provider that keeps your prompts by default and offers privacy as an enterprise add-on has told you what it thinks your data is for. We do not retain payloads on any tier. The sealed tier adds attestation on top — proof rather than promise — but the baseline is already that we are not reading your work.

Metered billing without verifiable records asks you to trust a number. Receipts exist so that the smallest customer can audit the same way the largest one can, using nothing but a signature and a public key.

Software that spends money on its own behalf will eventually do so by mistake. Treating the budget ceiling as a first-class property of the key — enforced before dispatch, not reconciled afterwards — is what turns a catastrophic bug into an ordinary one.