Per spend entry: the agent id, the payment rail, the service label, the amount, token counts, the model name and a timestamp. Per workspace: the workspace id, a hash of the workspace key, the plan and billing state, and — if you register one — an alert webhook URL. A workspace paid through the agent rail stores the paying wallet address — on that rail the wallet IS the workspace identity. If you subscribe through a marketplace (RapidAPI), we also store the marketplace account identifier it sends us so your subscription maps to a workspace. Keys and secrets are stored as hashes or as files readable only by the service.
Prompts and model responses. There is no field for them: the ledger records cost metadata, and the service has no code path that writes message content to storage. That is true of the hosted ledger today and is a design constraint on the proxy, which will meter cost without retaining payloads. The service and model fields are free-text labels you supply — do not put anything sensitive in a service name.
Railway hosts the service and its storage volume. Agent payments settle in USDC over the x402 protocol via the configured payment facilitator (Coinbase CDP or the public x402 facilitator), which sees the paying wallet address — we never see card numbers. RapidAPI (Nokia) processes marketplace subscriptions and tells us your marketplace account identifier when you call through its gateway. Stripe processed the human subscriptions sold before October 2026 and continues to process any of those subscriptions still renewing until they are cancelled (see Terms — Legacy subscriptions). Alert webhooks, if you register one, carry cost metadata to the URL you chose. The product does not send email to arbitrary addresses on your behalf. Nothing else receives your data.
We do not sell, rent or share your data, and we do not use it to train models.
Ledger data is kept while your workspace exists. Deleting an agent removes its ledger and secret; the operator can delete a workspace and its data on request. Alert delivery receipts are kept to a rolling window.
The marketing page and API set no advertising cookies. Aggregate counters (workspaces minted, requests) are collected without storing IP addresses — the service hashes them with a salt and keeps only the hash.
AgentLedger is operated by Parmanand LLC. Privacy questions and deletion requests: entradox@icloud.com.