Security and data flow

AICost decides. Your platform enforces. Your data stays where it is.

AICost works on numbers and names: workload volumes, token sizes, model choices, prices. It returns policy. Prompts, model outputs, documents and customer records stay in your cloud tenant or your vendor account, and your workloads keep running if AICost is unreachable.

No content

No prompts, outputs, documents, embeddings or customer records reach AICost.

Not in the request path

Your app calls the model through your own gateway, cloud or vendor API. AICost is never a hop.

Policy, not access

AICost returns budgets, caps and allowlists. It holds no credentials that can change your infrastructure.

You approve

A named owner approves each policy version, and every decision is kept in a tamper-evident journal.

What AICost sees, and what it never sees

DataReaches AICost?Notes
Workload parameters (volumes, token sizes, turns, review rates, model names)YesWhat the MCP engines and calculators run on. Sent by you, your team or your AI agent.
Cost and usage totals (dollars, tokens and tags per workload or key)Only if you connect itFrom your cloud billing export or gateway spend log, for actuals against plan.
Policy versions and approvalsYesAICost keeps the versions and the evidence journal so you can show who approved what.
Prompts and model outputsNoProcessed by your model provider inside your account or contract.
Documents, embeddings, vector dataNoStay in your storage and vector database.
Customer records, PII, PHINoAICost needs the data class (for example PHI), never the data.
Cloud or gateway credentials with write accessNoYour team applies the policy. AICost does not change your infrastructure.

Three workflows, end to end

Each example is computed live by the same engines as the demo. Read it left to right: the MCP chain prices and governs every step, the policy compiler turns the result into settings, and your enforcement point applies them.

1Customer support + RAG

Amazon Bedrock behind a LiteLLM gateway

Voice and chat front door, RAG over product docs, an agent that reads the CRM and issues refunds, human review on escalation.

What AICost received

Numbers and names only. The shape every chain call takes.

{
  "workload": "Customer support + RAG",
  "outcomes_per_month": 44000,
  "unit": "resolved case",
  "model": "claude-sonnet-5-5",
  "economy_model": "claude-haiku-5-5",
  "data_class": "Customer PII and order history",
  "engines": [
    "voice-agent-stack",
    "rag-pipeline",
    "vector-db-cost",
    "agent-loop-cost",
    "integration-cost",
    "retry-cost",
    "guardrail-security-cost",
    "observability-cost",
    "hitl-review-cost"
  ]
}

Cost envelope (cost-firewall engine)

$16,400budget / month
$711daily hard cap
$1.27per-run ceiling
12turn cap

Budgets cover model spend only. Reviewer time and integrations are real costs, but they are not spent through the gateway. Model spend in this example: $14,827/mo of $54,006/mo total.

Model allowlist for this data class

Claude Sonnet 5.5, Claude Haiku 5.5 · green for Regulated PII (GDPR/CCPA)

Who enforces it

LiteLLM in your VPC holds the budget, rate limits and model list; Bedrock cross-region inference and your AWS Budgets sit underneath.

Where the data lives

Customer chats, order history and help-center articles stay in your AWS account and your vector store.

Gateway config: LiteLLM (proxy config fragment)

{
  "router_settings": {
    "rpm": 420
  },
  "litellm_settings": {
    "max_budget": 710.67,
    "budget_duration": "1d"
  },
  "x_aicost_policy": {
    "firewall_policy": {
      "workload_id": "support",
      "scope": "workload",
      "monthly_budget_usd": 16400,
      "daily_warning_usd": 497.47,
      "daily_hard_limit_usd": 710.67,
      "max_cost_per_run_usd": 1.27,
      "max_model_calls_per_run": 12,
      "max_retries": 2,
      "max_output_tokens": 1200,
      "requests_per_min": 420,
      "anomaly": {
        "rolling_window": "7d",
        "spike_multiplier": 3,
        "rule": "flag any hour/day exceeding 3x the rolling average, or any single day above the daily hard limit"
      },
      "actions": {
        "warning_threshold": "notify",
        "soft_limit": "route_to:claude-haiku-5-5",
        "hard_limit": "block_noncritical_requests",
        "anomaly": "throttle_and_alert",
        "emergency": "block_all_and_require_approval"
      },
      "emergency_stop": {
        "enabled": true,
        "requires_approval_to_resume": true
      }
    }
  }
}

Cloud-native policy (cloud-gateway-policy engine)

  • Bedrock cross-region inference across 3 regions for resilience + capacity.
{
  "policy_type": "cloud_gateway_policy",
  "cloud": "bedrock",
  "cross_region_policy": {
    "model": "Claude Sonnet 5.5",
    "regions": [
      "us-east-1",
      "us-west-2",
      "eu-central-1"
    ],
    "note": "Cross-region inference reflects the source region rate; no extra fee."
  }
}

2Engineering + coding agents

Anthropic API behind Cloudflare AI Gateway

Developers hand tasks to a coding agent that reads the repo over MCP, runs tests, retries, and opens a pull request a human reviews before merge.

Agent Loop CostCoding agent turns →AI Agent Integration CostMCP tools: repository, CI, tickets →Eval Benchmark CostTest and eval runs →Retry Cost CalculatorRetries →LLM Observability / Tracing CostObservability →Human-in-the-Loop Review CostHuman PR review →AI Cost Firewall (budgets + anomaly + kill-switch)Deployment gate →Policy envelope$5,000/mo, $217/day, 20-turn cap →Cloudflare AI Gatewayenforces in your network →Anthropic APIvendor API, your account →Claude Sonnet 5.5economy route Claude Haiku 5.5

What AICost received

Numbers and names only. The shape every chain call takes.

{
  "workload": "Engineering + coding agents",
  "outcomes_per_month": 4400,
  "unit": "completed task",
  "model": "claude-sonnet-5-5",
  "economy_model": "claude-haiku-5-5",
  "data_class": "Source code and internal tickets",
  "engines": [
    "agent-loop-cost",
    "integration-cost",
    "eval-benchmark-cost",
    "retry-cost",
    "observability-cost",
    "hitl-review-cost",
    "cost-firewall"
  ]
}

Cost envelope (cost-firewall engine)

$5,000budget / month
$217daily hard cap
$4.41per-run ceiling
20turn cap

Budgets cover model spend only. Reviewer time and integrations are real costs, but they are not spent through the gateway. Model spend in this example: $4,500/mo of $71,974/mo total.

Model allowlist for this data class

Claude Sonnet 5.5, Claude Haiku 5.5 · green for Internal / business-confidential

Who enforces it

Cloudflare AI Gateway rate-limits and orders fallbacks; the per-key spend limit and model access are set in the Anthropic console by your admin.

Where the data lives

Source code and tickets go from your developers' tools to the Anthropic API under your Anthropic agreement. AICost sees task counts and token sizes only.

Gateway config: Cloudflare AI Gateway (gateway settings)

{
  "gateway_settings": {
    "rate_limiting": {
      "technique": "sliding",
      "requests": 60,
      "period_seconds": 60,
      "note": "requests per 60s"
    }
  },
  "x_aicost_policy": {
    "firewall_policy": {
      "workload_id": "engineering",
      "scope": "workload",
      "monthly_budget_usd": 5000,
      "daily_warning_usd": 151.67,
      "daily_hard_limit_usd": 216.67,
      "max_cost_per_run_usd": 4.41,
      "max_model_calls_per_run": 20,
      "max_retries": 2,
      "max_output_tokens": 4000,
      "requests_per_min": 60,
      "anomaly": {
        "rolling_window": "7d",
        "spike_multiplier": 3,
        "rule": "flag any hour/day exceeding 3x the rolling average, or any single day above the daily hard limit"
      },
      "actions": {
        "warning_threshold": "notify",
        "soft_limit": "route_to:claude-haiku-5-5",
        "hard_limit": "block_noncritical_requests",
        "anomaly": "throttle_and_alert",
        "emergency": "block_all_and_require_approval"
      },
      "emergency_stop": {
        "enabled": true,
        "requires_approval_to_resume": true
      }
    }
  }
}

Vendor console settings your admin applies (Anthropic API)

  • One API key per workload
  • Workspace or project spend limit set to the monthly budget
  • Rate limits set from the requests-per-minute in the envelope
  • Model access limited to the allowlist

Values: $5,000/mo spend limit, allowlist Claude Sonnet 5.5 + Claude Haiku 5.5.

3Ambient clinical documentation

Microsoft Foundry (Azure) with the CostWall proxy in your network

Get patient consent and start the ambient session from the EHR mobile app, then Record and transcribe the encounter, then Generate a structured note (HPI, exam, assessment and plan) plus orders and codes, then Clinician reviews, edits and signs in the EHR.

What AICost received

Numbers and names only. The shape every chain call takes.

{
  "workload": "Ambient clinical documentation",
  "outcomes_per_month": 120000,
  "unit": "visit note",
  "model": "claude-sonnet-5-5",
  "economy_model": "claude-haiku-5-5",
  "data_class": "Patient health information (PHI)",
  "engines": [
    "audio-cost",
    "cost-calculator",
    "prompt-cache-roi",
    "multi-model-router",
    "scale-projection",
    "eval-hallucination-cost",
    "hitl-review-cost",
    "compliance-cost",
    "jurisdiction-risk-scorer",
    "ai-seat-roi"
  ]
}

Cost envelope (cost-firewall engine)

$2,400budget / month
$104daily hard cap
$0.22per-run ceiling
6turn cap

Budgets cover model spend only. Reviewer time and integrations are real costs, but they are not spent through the gateway. Model spend in this example: $2,124/mo of $496,577/mo total.

Model allowlist for this data class

Claude Sonnet 5.5, Claude Haiku 5.5 · green for Health / financial (PHI, PCI)

Who enforces it

The CostWall proxy runs in your Azure network and holds the approved policy locally: per-run ceiling, turn cap, daily cap. Foundry spills provisioned capacity to standard on 429.

Where the data lives

Visit audio, transcripts and notes are PHI and never leave your Azure subscription and EHR. AICost knows the data class is PHI, which is why the model allowlist and review rate are strict.

Gateway config: CostWall proxy (local policy file)

{
  "firewall_policy": {
    "workload_id": "ambient-clinical-documentation",
    "scope": "workload",
    "monthly_budget_usd": 2400,
    "daily_warning_usd": 72.8,
    "daily_hard_limit_usd": 104,
    "max_cost_per_run_usd": 0.22,
    "max_model_calls_per_run": 6,
    "max_retries": 2,
    "max_output_tokens": 1200,
    "requests_per_min": 1140,
    "anomaly": {
      "rolling_window": "7d",
      "spike_multiplier": 3,
      "rule": "flag any hour/day exceeding 3x the rolling average, or any single day above the daily hard limit"
    },
    "actions": {
      "warning_threshold": "notify",
      "soft_limit": "route_to:claude-haiku-5-5",
      "hard_limit": "block_noncritical_requests",
      "anomaly": "throttle_and_alert",
      "emergency": "block_all_and_require_approval"
    },
    "emergency_stop": {
      "enabled": true,
      "requires_approval_to_resume": true
    }
  }
}

CostWall reads this firewall_policy block from a local file and keeps enforcing it if AICost is unreachable.

Cloud-native policy (cloud-gateway-policy engine)

  • Azure PTU spillover: route overflow from the provisioned deployment to standard on 429.
  • Capacity overflow: use provisioned capacity first, overflow to on-demand.
{
  "policy_type": "cloud_gateway_policy",
  "cloud": "azure-openai",
  "spillover_policy": {
    "provisioned_deployment": "ptu-claude-sonnet-5-5",
    "standard_deployment": "std-claude-sonnet-5-5",
    "trigger": "http_429_or_ptu_exhausted"
  },
  "capacity_overflow_policy": {
    "provisioned_deployment": "ptu-claude-sonnet-5-5",
    "on_demand_deployment": "ondemand-claude-haiku-5-5"
  }
}

Where the policy is enforced

Dynamic or static?

The policy is dynamic: AICost re-runs the engines as prices, models, spend and controls change and proposes a new version. Enforcement is static between versions: your platform applies the approved limits locally, with no live call to AICost on each request.

In the inference path?

The AICost service is not. It compiles policy into controls your vendor, cloud or gateway already enforces. The one optional exception is the CostWall proxy for per-request caps, which you run in your own network; it holds the approved policy locally, so if AICost is unreachable it keeps enforcing the last version and only the next update waits.

Vendor APIsOpenAI, Anthropic, Google, Mistral

Per-key budget, model allowlist and ceilings, applied by your admin in the vendor console (project and workspace budgets, rate limits, model access, one key per workload).

AICost reconciles from the usage export. Direct usage-API pulls and pushing limits through vendor admin APIs are on the roadmap.

Cloud AI platformsAmazon Bedrock, Microsoft Foundry, Google Vertex AI

The same policy in each cloud's native controls: inference profiles and tags, budgets and budget actions, quotas, model access, provisioned-then-standard spillover, context caching.

AICost reads the cost export (CUR, Cost Management, BigQuery billing) and flags drift per workload.

LLM gateways and routersLiteLLM, Cloudflare AI Gateway, Portkey, Kong, your own router

Compiled to gateway config: budgets per virtual key, daily caps, RPM and TPM, model allowlists, fallbacks, retries, cache. Anything a gateway cannot enforce natively is passed through for your app layer, never dropped.

Gateway spend logs feed the ledger; a cap that never fires is a finding.

Google Vertex AI, same chain

  • Vertex context caching for large recurring prompts (system prompt / RAG preamble).
If AICost is down, your workloads keep running. Enforcement lives in your vendor, cloud, gateway or your own CostWall proxy, never in the AICost service.

How AICost itself is run

HostingAICost runs on its own AWS infrastructure, outside your tenant. Public endpoints sit behind Cloudflare.
Access to the MCP enginesOAuth sign-in or a per-tenant API key. Each tenant's usage, policies and evidence journal are kept separate.
What we store for youWorkload parameters you save, policy versions, approvals and the evidence journal, and cost totals if you connect a billing or gateway export.
CertificationsAICost does not hold a SOC 2 report today. Because no customer content reaches AICost, most reviews close on this data flow and our questionnaire answers. Ask us where the SOC 2 work stands.

Running a vendor review?

We will walk your security team through this data flow on one of your workloads and answer your questionnaire.

See the live demoBook a security walkthrough
📖 Data sources & methodology 172 text models · 9 embeddings · 44 vision · 62 audio · 8 vector DBs across 10 vendor pages · last verified 2026-10-14

Methodology

  • All prices are USD per 1 million tokens, current as of 2026-10-14.
  • Vendor-published values have no mark. Inferred/extrapolated values are marked with * and listed below.
  • Batch API discounts are 50% off standard rates across providers that offer Batch mode.
  • Prompt caching discounts vary by provider (typically 80-90% off cached input tokens).
  • Regional data-residency surcharges (Anthropic 1.1x, OpenAI 1.1x, Google regional tiers) are NOT included in base rates.
  • Long-context pricing tiers apply when input exceeds model threshold.
  • Embedding prices are input-only (no output tokens generated).

Primary sources

Last-verified date is the most recent successful daily snapshot (aicost_pricing_snapshots) or, when no snapshot exists yet, the latest successful crawler run (aicost_crawler_runs). 10 of 10 vendors are currently verified. Aggregator services (TokenCost, AI Pricing Guru, etc.) are not listed.

Anthropic
2026-10-14
https://www.anthropic.com/pricing
Daily snapshot since Sep 2023 · 700 days captured
Anthropic Docs
2026-10-14
https://platform.claude.com/docs/en/about-claude/pricing
Daily snapshot since Sep 2023 · 700 days captured
OpenAI
2026-10-14
https://openai.com/api/pricing/
Daily snapshot since Sep 2023 · 701 days captured
Google AI
2026-10-14
https://ai.google.dev/gemini-api/docs/pricing
Daily snapshot since Dec 2023 · 676 days captured
Google Vertex
2026-10-14
https://cloud.google.com/vertex-ai/generative-ai/pricing
Daily snapshot since Dec 2023 · 676 days captured
DeepSeek
2026-10-14
https://api-docs.deepseek.com/quick_start/pricing
Daily snapshot since May 2024 · 615 days captured
xAI
2026-10-14
https://x.ai/api
Daily snapshot since Nov 2024 · 533 days captured
Mistral
2026-10-14
https://mistral.ai/pricing
Daily snapshot since Dec 2023 · 674 days captured
Cohere
2026-10-14
https://cohere.com/pricing
Daily snapshot since Sep 2023 · 700 days captured

Inferred values (marked with * in calculator tables)

Derived from industry conventions, not directly published by the vendor. Typical conventions: cached input = 10% of base (90% off), Batch API = 50% of base (50% off).

Vendor / Model Field Why it’s inferred
Anthropic — Claude Sonnet 4.6 cachedInput Derived at 10% of input rate — Anthropic publishes 90% cache-hit discount on this tier.
Anthropic — Claude Sonnet 4.5 cachedInput Derived at 10% of input rate; same 90% cache-hit convention as Sonnet 4.6.
Anthropic — Claude Sonnet 4.5 batchInput Derived at 50% of standard input — Anthropic documents uniform 50% Batch discount.
Anthropic — Claude Sonnet 4.5 batchOutput Derived at 50% of standard output — Anthropic documents uniform 50% Batch discount.
Anthropic — Claude Haiku 4.5 cachedInput Derived at 10% of input rate — Anthropic 90% cache-hit discount convention.
OpenAI — GPT-5.4 Mini cachedInput Derived at 10% of input — OpenAI documents automatic 90% discount on cache hits across GPT-5.x tier.
OpenAI — GPT-5.4 Nano cachedInput Derived at 10% of input — OpenAI 90% cache-hit convention.
OpenAI — GPT-5.4 Nano batchInput Derived at 50% of input — OpenAI Batch API uniform 50% discount.
OpenAI — GPT-5.4 Nano batchOutput Derived at 50% of output — OpenAI Batch API uniform 50% discount.
OpenAI — GPT-5.4 Pro cachedInput Derived at 10% of input — OpenAI 90% cache-hit convention.
OpenAI — GPT-5.4 Pro batchInput Derived at 50% of input — OpenAI Batch API uniform 50% discount.
OpenAI — GPT-5.4 Pro batchOutput Derived at 50% of output — OpenAI Batch API uniform 50% discount.
OpenAI — GPT-5.2 cachedInput Derived at 10% of input; no residency uplift.
OpenAI — GPT-5.2 batchInput Derived at 50% of input.
OpenAI — GPT-5.2 batchOutput Derived at 50% of output.
OpenAI — GPT-5 cachedInput Derived at 10% of input.
OpenAI — GPT-5 batchInput Derived at 50% of input.
OpenAI — GPT-5 batchOutput Derived at 50% of output.
OpenAI — GPT-5.5 Pro cachedInput Derived at 10% of input — OpenAI does not publish a cached rate for *-pro models; using the family convention.
OpenAI — GPT-5.5 Pro batchInput Derived at 50% of input.
OpenAI — GPT-5.5 Pro batchOutput Derived at 50% of output.
OpenAI — GPT-5.2 Pro cachedInput Derived at 10% of input — pro-tier convention.
OpenAI — GPT-5.2 Pro batchInput Derived at 50% of input.
OpenAI — GPT-5.2 Pro batchOutput Derived at 50% of output.
OpenAI — GPT-5.1 batchInput Derived at 50% of input.
OpenAI — GPT-5.1 batchOutput Derived at 50% of output.
OpenAI — GPT-5 Pro batchInput Derived at 50% of input.
OpenAI — GPT-5 Pro batchOutput Derived at 50% of output.
OpenAI — GPT-5 Nano cachedInput Derived at 10% of input.
OpenAI — GPT-5 Nano batchInput Derived at 50% of input.
OpenAI — GPT-5 Nano batchOutput Derived at 50% of output.
Google — Gemini 3 Flash cachedInput Derived at 10% of input — Google caching discount convention ~90%.
Google — Gemini 3.1 Flash-Lite cachedInput Derived at 10% of input — Google caching convention.
Google — Gemini 3.1 Flash-Lite batchInput Derived at 50% of input — Google Batch API uniform 50% discount.
Google — Gemini 3.1 Flash-Lite batchOutput Derived at 50% of output — Google Batch API uniform 50% discount.
Google — Gemini 2.5 Pro cachedInput Derived at 10% of input.
Google — Gemini 2.5 Flash cachedInput Derived at 10% of input.
Google — Gemini 2.5 Flash-Lite cachedInput Derived at 10% of input — Google caching convention.
Google — Gemini 2.5 Flash-Lite batchInput Derived at 50% of input — Google Batch API uniform 50% discount.
Google — Gemini 2.5 Flash-Lite batchOutput Derived at 50% of output — Google Batch API uniform 50% discount.
xAI — Grok 4 (legacy) cachedInput Extrapolated at 25% of base.

Pricing is cross-verified against the LiteLLM community registry when available. Daily snapshots are kept in aicost_pricing_snapshots; every change is logged to aicost_price_changelog with old & new values for full audit trail. Read the full methodology →