Credential access and security

The public sample dashboard uses bundled synthetic numbers and accepts no credentials. Joining the hosted waitlist does not connect an account.

Provider access

The self-hosted app uses provider credentials on its server to read billing reports or current infrastructure. The credential itself can have broader permissions. OpenAI and Anthropic require admin keys; these are not inherently read-only. Prefer the least privilege supported by the provider, including organization scope and billing permissions.

Follow the OpenAI setup guide or Anthropic setup guide. AWS uses Cost Explorer permissions; Google Cloud requires access to a billing-export BigQuery dataset and query execution; GitHub, Vercel and OpenRouter require their relevant billing or activity access. Supabase reads organization and project inventory through a Management API token. Check each provider’s console for current scope controls.

Encryption and recovery

Provider credentials are encrypted using AES-256-GCM under an organization data key, wrapped by the installation’s master encryption key. The browser receives only the saved key suffix. Database row-level security restricts organization access; service credentials must remain on the server.

Self-host operators must securely preserve the encryption master key and database backup together. Losing the master key can make saved credentials unrecoverable. A database backup alone is insufficient for recovery. Restrict server access and follow the repository’s recovery and rotation guide.

Replace or revoke access

Replace credentials through account settings. Revoke the old credential in the provider console; pausing or archiving an account in Tallypane does not revoke the provider’s credential. Review provider access periodically. This description is not a certification or an independent security audit.