Security & Compliance
Your data, our posture
CostLens processes agent descriptions, spend logs, and budget configuration data. This page states, plainly, what we handle and what we do not claim.
What we handle
We process AI-agent descriptions, spend logs, and budget configuration data you submit for cost attribution. These may contain business-confidential information but are not typically special-category personal data.
Data handling commitments
- Submissions run the cost-attribution pipeline and are retained only as long as needed for your audit log (Pro) or until you delete the run.
- We apply access controls consistent with GDPR Art. 32 (security of processing).
- BYOK keys are stored server-side only and never exposed to the browser.
Our compliance posture (honesty rule)
- CostLens is a cost-attribution tool, not a financial audit service. It provides cost tracking and alerting but does not replace professional financial management.
- We do not guarantee accuracy, do not claim "100% accurate cost tracking", and do not state you will "never miss a budget breach". Cost attribution depends on the quality of the data you provide.
- For binding financial advice, consult a qualified finance professional.
Subprocessors & payments
refs: GDPR Art. 32 · OWASP Top 10