Content-free by schema
The metering record has no field that can hold a prompt, a completion or a tool argument. That is a property of the schema, not a retention policy.
On this page
Recovea does not promise to delete your prompts. It has nowhere to put them. The metering is content-free by schema: every field of the record the gateway writes for a request is an id, a count, a timing, a status or a value from a closed list, and there is no field that can hold a prompt, a completion, a tool argument, a raw path or a header value.
What the record holds
For each request that goes through the gateway, one metering event:
| Kind | Fields |
|---|---|
| Ids | the request id, your organization, the key the request used |
| What was called | the provider, the endpoint class, the model you asked for and the model that answered |
| Counts | input, output, cached, reasoning and cache-write tokens, as your provider reported them; request and response sizes in bytes |
| Outcome | the provider's status, its finish or stop reason (from the provider's own closed list), whether it streamed |
| Timings | start, first byte from the provider, finish, and the time the gateway added |
| Cost, on a declared upstream | the cost the destination reported, when it reported one |
| Your labels | your tags, your project and your run id, exactly as you sent them |
A count your provider did not report is null, never a guess. The receipt written from the event is narrower still: twelve fields of ids, counts, a cost, a price-list version and a basis (Prove).
What the gateway reads, and what it keeps
The gateway reads your provider's response as it passes through, to take the usage block the provider reports: the token counts. It keeps the counts and nothing else. Request and response bodies are never buffered or written down, and the gateway's logs and metrics follow the same schema rule.
On a streaming chat completion the usage block only arrives if the request
asks for it, so the gateway asks on your behalf when your request says nothing
about stream_options, and leaves the request alone when it does
(Meter).
The only text of yours that is stored
Your own labels: the values of x-recovea-tags, x-recovea-project and
x-recovea-run-id. They are opaque. They are stored as you sent them so you can
cut your spend by them, and nothing interprets them or resolves them to a
person (Tags).
Recovea never reads a prompt to decide what a request was for. Every label on a cost comes from you.
The same rule on the passive tap
The passive tap reports a call's envelope from your own process instead of routing it. Its schema is a published table of fifteen fields, and the server refuses a whole batch that carries any field not in the table, rather than trimming it, because trimming a field would mean reading it first.