What we store
- Your account. You sign in with Google through Firebase Authentication. We get your Firebase user ID, email address, name and profile picture URL, and we note when you signed up and when you were last active.
- Organizations and teammates. Organization names and settings, members and their roles, and invitations, including the email address each invite was sent to.
- Provider credentials. The API keys, tokens and OAuth grants you connect. They are encrypted before they are stored (see Security), and once saved we only show their last four characters.
- Spend and usage data. What your providers report: cost and usage per hour and per day, broken down by service and resource (such as project, workspace, API key or model names), plus the account name and ID we find when you connect.
- Budgets and alerts. Your budgets, alert rules and alert channels: email addresses, Slack and Discord webhook URLs, your own webhook URLs and their signing secrets, and PagerDuty routing keys. We keep the alerts we raised and whether each delivery worked.
- Killswitch records. Which brake ran on which resource, who started it, the provider settings we need to undo it, and the result.
- Audit log. Changes made in your organization, such as connections, credentials, brakes, members and billing, with who made them and the IP address the request came from.
- API keys and agent access. Team API keys are stored only as a hash plus a short prefix, so we can't recover a lost key. When an AI agent asks for a setup link, we store a hash of its token, the name it gives, the IP address it came from (for IPv6, the network part) and the city and country that address maps to, which we show you before you approve it.
- Billing. Stripe processes payments, and we never see or store card numbers. We store your plan, billing interval and subscription status, and our payments service keeps your billing email address and Stripe customer ID.
- Analytics. This website and the dashboard use Clicktag to count page views and events: on this website, things like button clicks; in the dashboard, things like signing in, connecting a provider, creating a budget or upgrading. Invite and confirmation tokens are removed from the address bar before analytics loads.
How we use it
We use this data to run Costbrake: read your providers' usage, calculate spend and forecasts, raise and deliver alerts, run and undo the brakes you start, send the emails you ask for (alerts, address confirmations, invites, trial notices and the weekly digest), bill paid plans and keep the service secure. Analytics show us which pages and features people use.
Most of this is needed to provide the service you signed up for. The audit log, network logs and analytics rely on our legitimate interest in keeping Costbrake safe and making it better.
What we never do
We don't sell data, show ads or share your spend data with other customers. We only use your credentials for the reads and brakes described here, and we don't use your data to train AI models. Our emails don't track opens or link clicks.
Who processes it
- Cloudflare: hosting for this website and the app, database connections (Hyperdrive), queues and network logs;
- OVH: PostgreSQL database hosting in Germany;
- Google (Firebase Authentication): sign-in;
- Postmark: sending email;
- Stripe: payments, as merchant of record for our paid plans;
- Clicktag: website and dashboard analytics;
- the providers you connect, which we call with your credentials, and the alert channels you set up (Slack, Discord, PagerDuty or your own webhooks), which receive alert details.
Some of these companies are based in the United States, so your data can be processed outside the EU.
Retention
- Hourly usage data: 35 days.
- Daily spend totals and alert history: 30 days on Free, 12 months on Pro and 36 months on Team. When an organization moves to a plan with less history, for example when a trial ends, the next daily cleanup deletes the older data.
- Sync logs: 14 days.
- Audit log: 1 year.
- AI agent setup sessions: 30 days after they end.
- Disconnecting a provider deletes that connection's credentials, spend data, sync logs and killswitch records right away.
Everything else, such as your account, organizations and alert channels, is kept until you delete it or ask us to.
Your rights
You can ask to see, correct, export or delete your personal data, or object to how we use it, at any time: email bart@bitgate.com from the address on your account. Admins can remove connections, alert channels, API keys and members themselves.
If you are in the EU, you can also complain to your data protection authority. In the Netherlands that is the Autoriteit Persoonsgegevens.
Security
All traffic is encrypted with TLS.
Provider credentials use envelope encryption. Each secret is encrypted with AES-256-GCM under its own random key, and that key is encrypted again with a master key that is never stored in the database. Read credentials and killswitch credentials have separate master keys. Every encrypted secret is bound to its organization and connection, so it can't be decrypted for any other one.
Only the background service that reads your providers holds the master keys. The part of Costbrake that serves the dashboard can't read stored credentials at all. API keys, invite links, setup links and confirmation tokens are stored as hashes.
Report security issues to abuse@bitgate.com.
Changes
We may update this policy as Costbrake changes, and the date at the top shows when. Material changes will be called out on this page.
Contact
Costbrake is run by Bitgate, Inc. Privacy questions and requests go to bart@bitgate.com, security reports to abuse@bitgate.com.