AI policy

CostSlice is not an AI gateway. We do not route across models. We do not cache completions. We do not issue virtual keys. OpenAI only. You keep your OpenAI API key. We pass the call through and count it.

We do not place an AI system on the Union market under our name. We are not a provider of a general-purpose AI model. We are not the deployer of the AI feature in your product. You are. OpenAI is the provider of the model that fulfills the completion, under the OpenAI API key you provide. CostSlice does not generate content for a natural person, does not chat with an end user, and does not make a decision about a person.

Your use of the model is still under OpenAI’s terms and usage policies. CostSlice does not replace them. If OpenAI refuses a call, we do not override that. We cannot police what you typed, because we do not store prompt or completion bodies.

If your product interacts with people in the EU using a model, you (as deployer) and OpenAI (as provider) own the Art. 50 disclosures. We do not rewrite prompts or completions, so we do not strip watermarks or provenance headers. We do not add our own user-facing AI chat.

CostSlice is a cost and usage report. It is not an Annex III high-risk AI system. We do not offer prohibited practices. If you send that kind of traffic through the proxy, you are still the deployer of your system. Do not use CostSlice to run a prohibited practice.

The P&L does not cap, block, or auto-price a customer because a row is red. Starter is a hard cap on the CostSlice plan, not a tenant kill switch. Use an opaque customer ID, never a name or email.

We do not store prompt bodies. We do not store completion bodies. We take no training rights. We do not train, fine-tune, evaluate, or improve a model on your traffic. Retention of usage metadata follows the plan: 7, 90, or 365 days. See Privacy and the DPA.

If a later feature sent content to a model other than the customer’s own OpenAI call, that provider would be added to DPA Annex 3 and Privacy with 30 days’ notice before anything shipped.

A missing tenant ID still completes and lands in untagged. Starter at 10,000 requests: New proxy calls stop until you upgrade. That is the Starter plan cap, not a per-customer block.

That is fail-open ingest, not a promise the call always runs. Starter is a hard stop at 10,000 requests per month. Callers get the product hard cap: New proxy calls stop until you upgrade. That is the Starter plan cap, not a per-customer block. The dashboard marks that state data-plan-cap="hard" as “Starter is at its request cap”.

We are not SOC 2 or HIPAA certified. We are not an AI-safety vendor. We are not a model provider. UK data-protection complaints: ICO. Policy questions: hello@costslice.com.