“Do You See Our Prompts?” How KeepAir Handles Your Data
The first question every CISO asks about an AI cost tool. For KeepAir, the answer is no. Here's how it works.
Every FinOps leader who has tried to bring a new cost tool into an enterprise knows the moment. The demo goes well, finance is on board, and then security asks the question that decides the deal: what exactly does this tool see?
For AI cost management, that question carries extra weight. Prompts can contain customer data, source code, contracts, and internal strategy. A CISO is right to treat any tool that touches AI traffic as a potential data exposure. So here is a direct answer for KeepAir.
The short answer: no
KeepAir does not collect prompt or response content. It works from usage and billing metadata: who made the request, which model served it, how many tokens it used, and what it cost. That is the data FinOps needs for cost allocation, showback, and forecasting. Nothing more is required, so nothing more is collected.
Nothing sits in the request path
Some AI cost tools work as a gateway or proxy. Every request your applications send to a model passes through them first. That design gives deep visibility, but it also puts a third party inline with production traffic, adds a dependency to every call, and expands the scope of your security review.
KeepAir takes a different approach. It reads usage and billing data from each vendor's own APIs. Your AI traffic never passes through KeepAir. If KeepAir were unavailable for an hour, your applications would not notice.
Access controls built for enterprise review
Security teams usually ask a standard set of follow-up questions. Here is how KeepAir answers them:
- Authentication. Optional SAML single sign-on with Microsoft Entra, set up per organization, or email and password.
- Authorization. Viewer, Member, and Admin roles, each with a data scope per person. A team lead can see their own team's spend without seeing the whole company.
- Self-signup control. Optional self-signup can be limited to your company's email domains.
- Revocation. Access for any member can be revoked in one click.
- Operations. A fully managed SaaS platform. There is nothing to install or maintain on your side.
Backed by a vendor procurement already knows
KeepAir is powered by Ness Technology, an enterprise IT partner many organizations already work with. For procurement and security, that means reviewing a platform backed by a vendor they may have approved before, with long-term continuity behind it.
Why this design matters for FinOps
Governance only works when the people who own spend can see it. If security blocks the tool, FinOps falls back to spreadsheets and vendor consoles, and AI spend stays unallocated. A metadata-only, out-of-path design is what lets a cost platform pass review quickly and reach the teams that need it.
The bottom line for your security review
- No prompt or response content collected
- No production AI traffic routed through the platform
- Role-based access with per-person data scope
- SSO through Microsoft Entra
Bring your security team into the conversation early.
Also published on LinkedIn. Follow KeepAir on LinkedIn