Asked and answered.

By default, the SDK keeps raw prompt and response text on your machine and sends content-blind commitments plus operational metadata. Do not add raw content to custom fields, and it never leaves your process. There is no raw-text column anywhere in our schema. More in the Privacy Policy and on Trust & Security.

pip install foxy-audit, then wrap one function with the decorator — your code stays unchanged. There are three supported ways in, covered step by step in the install guide.

On Pro and Max — and on a free account — you do: you bring your own Gemini or OpenAI key, add it in the dashboard, and those model calls land on your provider bill at your rates. Audit-event credits cover capture, chaining, anchoring and exports; they are not model tokens. Premium can either keep using its own key or switch to Foxy's managed keys, where the model calls are on us. Your key is stored encrypted, used only in memory at grading time, and never shown back to you or written into your audit chain. See how the judge works.

Yes — that is the point. Every record is bound into a per-organisation hash chain that anyone can recompute offline from an export, using a dependency-free verifier that ships inside the export bundle itself. The export contains everything needed to prove us wrong. Try it on the verify page.

Pro and Max are monthly subscriptions in US dollars. Payment is handled by Paddle, who act as the merchant of record and appear as the seller on your statement and your receipt — card details are entered on Paddle's checkout and never reach Foxy Audit. Any sales tax or VAT is calculated and remitted by Paddle at checkout. Premium is agreed in writing and invoiced directly, so it does not go through the card checkout at all. Full details on the pricing page.

We're currently completing our SOC 2 Type I audit. Until it's issued, we won't claim certification — we'll tell you exactly where we are in the process. Foxy Audit produces compliance evidence, not certifications, and that distinction is written on every page that could blur it. Current status on Trust & Security.

Your hash chain is append-only and independently re-computable, so an outage doesn't corrupt or invalidate what's already been recorded. New calls queue in the SDK's durable local spool and upload when we're back — capture never blocks your request path. The mechanics are in how it works.

Yes — Pro and Max can be cancelled from the dashboard and remain available through the paid period, so you keep what you have already paid for. Premium follows the terms in your agreement. See the refund policy.