Trust & security

Exactly what Tokkara can see, and nothing more.

Everything a security review needs, without signing up: the permissions we ask for, what happens to prompts, how data is stored and how to cut us off.

Access

The permissions we ask for

Permissions Tokkara uses per provider
Provider	Credential	What Tokkara calls
AWS Bedrock	A read-only IAM role you deploy with CloudFormation, assumed with an external ID	`s3:ListBucket` `s3:GetObject` `bedrock:GetModelInvocationLoggingConfiguration` `ce:GetCostAndUsage` `cloudwatch:GetMetricData` `cloudwatch:ListMetrics` `cloudtrail:LookupEvents`
OpenAI	An admin key	`GET /v1/organization/usage/completions` `GET /v1/organization/users` `GET /v1/organization/projects/{project_id}/api_keys`
Anthropic	An admin key	`GET /v1/organizations/usage_report/messages` `GET /v1/organizations/users` `GET /v1/organizations/api_keys`

These providers only expose usage data to admin keys; Tokkara only calls the GET endpoints listed. The user and API key listings are read only to show names instead of ids. The Bedrock role has no write permissions, and Tokkara never creates resources in your account.

Bedrock IAM permissions policy

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "ListInvocationLogs",
      "Effect": "Allow",
      "Action": [
        "s3:ListBucket"
      ],
      "Resource": "arn:aws:s3:::<YOUR_LOGS_BUCKET>"
    },
    {
      "Sid": "ReadInvocationLogs",
      "Effect": "Allow",
      "Action": [
        "s3:GetObject"
      ],
      "Resource": "arn:aws:s3:::<YOUR_LOGS_BUCKET>/*"
    },
    {
      "Sid": "ReadUsageAndCost",
      "Effect": "Allow",
      "Action": [
        "bedrock:GetModelInvocationLoggingConfiguration",
        "ce:GetCostAndUsage",
        "cloudwatch:GetMetricData",
        "cloudwatch:ListMetrics",
        "cloudtrail:LookupEvents"
      ],
      "Resource": "*"
    }
  ]
}

Attribution

How cost is attributed per provider

Attribution level per provider
Provider	Attributed to	How	What you need
AWS Bedrock	Person	The IAM user or assumed-role session recorded on every invocation log, such as an SSO user's email.	Model invocation logging switched on, delivering to S3.
OpenAI	Person, API key or project	The user who owns the API key when keys are user-owned; otherwise the API key, then the project.	An admin key. Name keys and projects clearly so they read well in reports.
Anthropic	Person, API key or workspace	The Console user for Console and Claude Code sign-in usage; otherwise the API key, then the workspace.	An admin key from the Anthropic Console.

Any person, API key, project or workspace can be mapped to a team in Tokkara.

Prompt scanning

What happens to prompt text

Where it runs: on Tokkara's servers, while syncing your Bedrock invocation logs. OpenAI and Anthropic usage APIs don't include prompts, so only Bedrock is scanned.
What it looks for: cloud and API keys, private keys, tokens and passwords, email addresses, payment card numbers, US Social Security numbers and phone numbers.
What is kept: the type, severity, model, person, time and a redacted value (for example AKIA***MPLE). Prompt text is never stored by the scanner.
Defaults: scanning is on and can be switched off by an org admin in Privacy settings. First-prompt previews for Claude Code sessions are off by default for new organizations; admins can switch them on or off at any time.
Who can see findings: members of your Tokkara organization, on the Security page. Every admin change is recorded in the audit log.

Data handling

How your data is stored

Provider credentials are encrypted at rest with AES-256-GCM and are never shown again after you save them.
All traffic to Tokkara and to provider APIs uses TLS.
Retention is yours to choose: 90, 180, 365 or 730 days, or forever. Usage, sessions and findings past it are deleted daily.
Stored previews can be deleted at any time from Privacy settings; switching previews off deletes them too.
Our hosting region is available on request. Ask us.

Revoking access

Cut Tokkara off at any time

AWS Bedrock

Open CloudFormation in the AWS account you connected.
Delete the stack that created the TokkaraReadOnly role.
The role and its policy are removed, and Tokkara can no longer read anything.
Connected with an access key instead? Deactivate it in IAM.

OpenAI

Open Organization settings → Admin keys.
Revoke the key you gave Tokkara.

Anthropic

Open the Anthropic Console → Settings → Admin keys.
Delete the key you gave Tokkara.

Compliance

Where we stand

Tokkara is not yet SOC 2 audited. A completed security questionnaire is available on request.

Request the security questionnaire

Savings method

How we estimate savings

What we use: Every Bedrock request from the last 30 days, with its exact input, output and cache tokens, priced at your current rates and projected to a month.
Newer model upgrades: The same tokens repriced at the successor model's rates. Successors are newer models in the same family, never a smaller one.
Global routing: Requests on in-region Claude inference profiles cost about 10% more than the global profile; the saving is that difference.
Idle cache rebuilds: Session turns that rewrote the prompt cache after a 5 to 60 minute pause, priced as the gap between cache-write and cache-read rates.
Long context: Cache-read tokens beyond 150k per turn: the spend you could avoid by compacting earlier.
Assumptions: Traffic stays at the same volume and mix. Opportunities worth $1 a month or less are dropped. After you mark a fix as rolled out, the saving is measured, not estimated.

Validate quality on a sample before rolling out a model change.