Security & PDPA
Holding as little of your data as possible.
Spendlight™ does its job — showing what your AI costs and where it is wasted — without needing your keys or your prompts. Here is what that means in practice.
What we never store
- Your AI provider API keys. They pass through each request and are not written to disk or logs.
- Your prompts. The repeat-request cache uses a one-way SHA-256 hash of the request.
- Your uploaded spend files. Analysed in memory, then discarded.
What we do store, and why
- Account details (work email, company, hashed password) to log you in.
- Usage metering — token counts, model names and costs — to power the dashboard and budgets.
- Cached AI responses for the exact-repeat cache, so identical requests are not billed twice. These are stored server-side.
- For the Seat Auditor: GitHub organisation name, seat usernames and last-activity dates, plus an encrypted access token.
How it is protected
- HTTPS everywhere.
- Passwords hashed; stored access tokens encrypted at rest.
- Content-Security-Policy, CSRF protection and rate limits.
- Automated daily backups with integrity checks.
- Production access restricted; source code is private.
PDPA. Myriagon Sdn Bhd is the data controller. We collect personal data with consent and to provide the service, and you can ask to access, correct or delete it at any time by writing to inquiry@spendlight.co. This page is a plain-language summary, not legal advice; the binding terms are in the Privacy Policy and Terms of Service.