How TokenSave handles your data, keys, and requests.
Our recommended integration. The SDK runs entirely inside your own infrastructure. API keys are used locally to make direct calls to AI providers — they are never transmitted to TokenSave servers.
// Data flow with SDK
Your App → TokenSave SDK (your server) → AI Provider
↓
Anonymous stats only
(request count, tokens saved)
Deploy TokenSave on your own infrastructure. Our entire codebase is open source — audit every line before deploying.
If you use our hosted proxy, here is exactly what happens with your data:
| Data | Stored? | Details |
|---|---|---|
| API keys | Never | Forwarded to provider per-request. Immediately discarded from memory. |
| Prompts | Hashed only | A one-way hash for cache matching. Original text is not stored. |
| Responses | Cached 30m | Stored in Redis with TLS in transit. Auto-deleted after 30 minutes. |
| Usage stats | Yes | Request count, tokens saved, cache hits. Powers your dashboard. |
| IP addresses | Never | Hashed for rate limiting only. Raw IPs never stored. |
Rate limiting
60 requests/minute per key with standard headers
Input validation
All inputs sanitized, control characters stripped
Security headers
HSTS, X-Frame-Options, CSP, XSS protection on every response
Attack path blocking
Common exploit paths (/wp-admin, /.env, /.git) return 404
Request size limits
Maximum 500KB per request, 100K chars per message
Audit logging
All security events logged with hashed IPs
CORS headers
Proper CORS on all API routes for cross-origin access
TLS encryption
All connections use HTTPS with TLS 1.2+
Questions? prathamg200404@gmail.com