Building AtlasBurn · 2 min read
Content-blind by design — your cost tool should never see your prompts
To tell you what your AI costs, a tool needs token counts. It doesn't need your customers' conversations. Here's why we drew that line, and where it holds.
By Akhil Anand · October 8, 2026
A lot of LLM tooling works by capturing everything: full prompts, full completions, every tool call, stored and searchable. For debugging model quality, that's often exactly what you want.
For cost governance, it's the wrong default. The question "what is this costing us and should we stop it?" can be answered entirely from metadata. And the moment a cost tool stores your prompts, it becomes one more system holding your customers' data — one more vendor review, one more breach surface, one more reason legal says no.
What we capture, and what we don't
AtlasBurn captures model, token counts, latency, cost, and the feature the call belongs to. That's enough to attribute spend, forecast burn, and detect runaway agents.
It's even enough for behavioral detection. Our loop detection doesn't read text to decide a call is a repeat — it looks at the shape of traffic: identical model and token fingerprints, context that grows monotonically call after call, bursts of requests in a 30-second window. A retry storm has a signature in the numbers. You don't need the words.
If your cost tool needs your prompts to tell you what you spent, it's a logging tool with a cost column.
Where the line holds
In the SDK. Prompt text is only ever read locally, to estimate token counts when a provider doesn't report them. The estimate is sent; the text isn't.
In storage. Telemetry is written server-side only. Ingest keys are stored as salted HMAC hashes, and edge flags use opaque derived identifiers rather than raw keys.
In the Claude connector. AtlasBurn's MCP server exposes five read-only tools, scoped to atlasburn:read, returning aggregated economics only. Its tokens are accepted by that one endpoint and nowhere else, so even a compromised connection can't write anything or see content that was never collected.
The commercial reason, too
Content-blindness isn't only an ethics stance — it's what lets a cost tool get approved quickly. Security reviews go faster when the answer to "what data do you hold?" is "token counts and model names." Teams in regulated industries can adopt it without a data-processing exception.
Privacy that depends on a policy can change. Privacy that comes from never collecting the data doesn't.