For Security & Compliance · Every token counts.
The budget is the second factor.
Identity, budget, expiration — signed into the token envelope itself. PII fails closed before the call leaves your network. Audit rows the app role literally cannot rewrite. Sleep through the leaked-key incident.
Saturday, 2:11 AM
Priya is on call. Last year, this woke her up. This year, it didn't.
A junior dev pushes a key to a public repo
In April 2026 — we know how this ends.
Crawlers find it in minutes. Four-figure invoice by sunrise. Frantic calls to four vendors, reconstructing damage from provider dashboards. (We lived it. That's why we built this.)
Saturday, 2:11 AM, with TokenTotal
Cap exhausted. 402 returned. No LLM call.
The key's budget envelope says $50 max. By 2:11 AM that's gone — every subsequent request hits a 402 Payment Required before it touches Anthropic or OpenAI.
Monday morning
Priya gets an inbox digest, not a call.
“Key revoked: budget cap reached. Total exposure: $50. Source IP: AS-13335. Owner: dev-test-key.” She rotates it before standup. Nobody else hears about it.
What becomes true
Four headlines you don't have to write a postmortem for.
A leaked key with no budget left is a 402, not a four-figure surprise.
PII never leaves your network — twelve detectors, fail-closed by default.
The auditor asks for evidence; you click twice. The CC mapping is already done.
Model allowlists per project, per team — enforced in-flight, not on a wiki page.
How it actually works
Append-only at the SQL role, not the application.
The application's database role has UPDATE and DELETErevoked on the five audit tables. A deploy-time smoke check fails the rollout if those privileges were somehow restored. The audit isn't a promise — it's a constraint the database enforces.
-- Run on every deploy. Fails the rollout if any audit table is mutable
-- by the app role.
SELECT table_name
FROM information_schema.role_table_grants
WHERE grantee = 'acc_app'
AND privilege_type IN ('UPDATE', 'DELETE')
AND table_name LIKE '%_audit';
-- ⇒ must return 0 rows. Otherwise: deploy aborted.
-- PII pre-flight: 12 detectors, fail-closed
{
"policy": "obfuscate",
"detectors": ["ssn","email","phone","cc","health_*","name_*","ip"],
"fail_mode": "closed",
"on_unknown": "block"
}Integrations the auditor recognizes.
BYOK on the providers your security team already trusts. Audit-pack export to the tools your compliance team already runs.
AWS KMS
BYOK key custody — enterprise roadmap (Phase 6.1)
Azure Key Vault
Customer-held key custody — enterprise roadmap
GCP Cloud KMS
FIPS-validated custody — enterprise roadmap
Vanta
Continuous evidence sync for SOC 2 / ISO 27001
Drata
Control-mapped audit pack export
Splunk / Datadog
Append-only audit log streaming for SIEM
Three other people are asking different questions.
The same row in our ledger answers all four. Pick the door that matches the meeting you're in.
Frequently asked questions
What is LLM governance?+
LLM governance is the set of controls that decide what AI usage is allowed, by whom, and within what limits — enforced on the request path rather than reviewed after the fact. In practice it means identity on every call, budgets that refuse over-limit spend, PII controls before data leaves your perimeter, and a tamper-evident audit trail an auditor will accept.
How does TokenTotal stop a leaked API key from draining our budget?+
A binding key. Spending requires a second factor attached to the virtual key, so the key string alone isn't enough. A token that leaks without its binding key is a dead key — the leaked string fails closed with a structured 401, and every rejection is recorded for the auditor as data, not an incident report after the fact.
Can PII reach our model providers?+
A fail-closed PII pre-flight scans each prompt before it leaves your network — 12 detectors — and blocks or redacts sensitive data. 'Fail-closed' means if the scan itself errors, the call is dropped rather than waved through. The auditor's question 'can PII reach your providers?' has a control behind it, not a hope.
What compliance frameworks does the evidence pack cover?+
SOC 2, ISO 27001, ISO 42001 (the AI management-system standard), and NIST AI RMF. The continuous-evidence pack is productized — 12 collectors across the four frameworks, output as signed JSON with a flat CSV variant, plus an offline verification CLI so an auditor can re-derive the fingerprint locally with no network call.
Is the audit trail really tamper-proof?+
It's append-only at the SQL layer, not in application logic. The application database role has UPDATE and DELETE revoked on the five audit tables, and a deploy-time smoke check fails the rollout if that privilege was ever restored — so no one, including an admin, can quietly rewrite history.