Per entry: agent id, rail, service label, amount, token counts, model name, timestamp. Per workspace: workspace id, a hash of the workspace key, plan and billing state, and any alert webhook you register.
Prompts and model responses are never stored. There is no field for them and no code path that writes message content to storage. That is true of the ledger and it is a hard constraint on the proxy: it meters cost from the provider's usage payload without retaining the payload. Verified in the proxy's own test suite, which asserts no prompt text reaches the data directory.
In pass-through mode your provider key rides in the request headers, is forwarded verbatim, and is never written to disk or logged. A test greps the entire data directory for it after a proxied call and fails if it appears. You can therefore use the proxy without giving us a key at all.
Two mechanisms, and the difference matters:
402 before the provider is contacted. Spend is genuinely stopped./v1/track — the ledger write that would
cross the cap is rejected. Recording stops. The charge, if your agent already
made it, does not.A caller who can reach the provider directly can always bypass any proxy. Use the wrapper or proxy path if a cap has to be real.
Workspace keys and agent secrets are stored hashed or in files readable only by the service. The workspace owner can rotate any agent's secret and revoke the old one. Keys are never placed in URLs by our own pages — the dashboard sends your key as a request header.
Email entradox@icloud.com with the
subject line SECURITY, including what you found and how to
reproduce it. We will confirm receipt, tell you what we intend to do, and credit
you if you want the credit. Please do not test against other people's
workspaces, run destructive tests, or access data that is not yours.
Live health and version: /status · /health.
AgentLedger — not affiliated with agentledger.co or other same-named projects · start in 5 minutes