Privacy Policy
Last updated July 2026
Skalpel is content-free by default. We meter, attribute, and reconcile your AI usage without ever reading your prompts or responses, unless you explicitly turn on the consent-gated content archive.
What we collect
By default Skalpel records usage metadata only: token counts, model names, timestamps, your organization ID, and a per-request fingerprint. The metering spine is content-free, so it never carries the text of your prompts or the model's responses.
Prompt and response content
We do not capture the content of your AI calls unless you explicitly enable the consent-gated content archive for your organization. When enabled, transcripts are stored only for the organization that consented and are governed by the retention and erasure controls below.
How we use your data
We use usage metadata to meter your spend, attribute it to teams, people, and features, reconcile it against your provider's invoice, and power the behavioral steering you configure. We do not use your data to train models, and we never sell it.
Tenant isolation
Every record is isolated to your organization with database row-level security. Skalpel never blends one customer's data with another's, and any usage we cannot attribute is kept in its own bucket rather than guessed at.
Storage and security
Data is encrypted in transit and at rest. Encryption keys are held in AWS KMS custody, and access is least-privilege and audited. Skalpel runs on AWS infrastructure.
Your rights
You can request access to, export of, or erasure of your data at any time. Erasure requests propagate through our archives, including tombstoned rows pruned from analytical storage, in line with GDPR Article 17.
Contact
Questions about privacy? Email [email protected].