Data sovereignty
Your keys. Your data.
Your compliance.
Most AI monitoring tools hold your API keys on their servers and route every prompt through their infrastructure. That means they can see your prompts, your responses, and your provider credentials. We took a different approach — and we are precise below about exactly where your data goes in each mode, because a sovereignty claim is worth nothing if it is vague.
With Cited Monitor, your API keys travel from your browser directly into AWS SSM Parameter Store, encrypted and isolated per team, using short-lived credentials scoped to your team's path alone. They never pass through our application servers and are never written to our logs.
How it works
Your keys never touch our servers
When you add an API key, it goes from your browser straight to AWS. Here is exactly what happens:
Your browser
You paste your API key into the settings page.
AWS STS
Browser gets temporary, scoped credentials. Write-only — cannot read existing keys.
AWS SSM Parameter Store
Key stored encrypted at rest (AES-256). Isolated per team.
Lambda function
Reads key from SSM at runtime. Sends prompt to provider. Key stays in AWS.
LLM provider
OpenAI, Anthropic, Google, etc. Only they see your prompts and responses.
Your API keys travel from your browser directly to AWS. They never pass through our servers.
Our application server never handles, stores, or has access to your API keys at any point. The STS credentials issued to your browser are write-only — they cannot read back existing keys.
Best practices
Create least-privilege API keys
We recommend creating a dedicated, restricted API key for each provider you connect. This limits the blast radius if any key is ever compromised — regardless of where it is stored.
OpenAI
- • Create a project-scoped API key (not a user-level key)
- • Set a monthly usage limit in the Billing → Limits section
- • Enable email alerts at your chosen threshold
Anthropic
- • Create a workspace-scoped API key
- • Set a monthly spend limit in Settings → Limits
- • Configure usage alerts to notify you before the cap is reached
- • Generate a key restricted to the Generative Language API only
- • Set per-minute and per-day quotas in the Google Cloud Console
- • Enable billing alerts on the linked billing account
Mistral, Perplexity & Together
- • Create a dedicated API key for Cited Monitor (not your primary key)
- • Enable billing alerts in each provider's dashboard
- • Set monthly budget caps where supported
Connection modes
Three ways to connect
The choice is per provider, not per account — you can combine all three. Most tools make the choice for you and don't mention it.
| Your own provider keys Maximum sovereignty | A single OpenRouter key Fastest setup | Our managed key Just show me | |
|---|---|---|---|
| Keys to set up | One key per provider | One key, every model | No key needed |
| Where your prompts travel | CitedMonitor → the model provider | CitedMonitor → OpenRouter → the model provider | CitedMonitor → the model provider, on our account |
| What it costs | Provider rates. No markup from us. | Provider rates plus OpenRouter's routing fee. | Included, and capped. |
| Best for | Regulated buyers, and anyone who wants their prompts to reach nobody but the model provider. | Getting running in minutes instead of provisioning six provider accounts. | The free audit and your first few runs, so you see a real report before setting anything up. |
| Combine with the others? | Yes. You connect keys per provider, so most teams end up mixing — and you can change any provider's mode without touching the rest. | ||
You don't have to pick just one
Keys are connected per provider, so these combine freely. A common setup: your own OpenAI and Anthropic keys, because those are the models that matter most and you want nothing sitting in the middle — plus an OpenRouter key to cover Gemini, Mistral and Perplexity without opening three more accounts.
Most people start on the managed key, since it costs nothing and produces a real report in about a minute, then move providers across one at a time as it becomes worth it. Nothing is locked in: changing one provider's mode leaves the rest alone, and your history stays intact.
Comparison
BYOK vs bundled-key vendors
Most AI monitoring tools bundle API access into their pricing. That gives them access to your keys, your prompts, and your responses. Here is how the two models compare:
| Cited Monitor (BYOK) | Bundled-key tools | |
|---|---|---|
| Who holds your API keys? | Encrypted in AWS SSM, isolated per team. Written straight from your browser, never through our app servers. | The vendor |
| Who sees your prompts? | Only the LLM provider | The vendor + the LLM provider |
| API cost markup | None — pay providers at cost | 10–20x markup typical |
| Spend control | Your provider dashboard | Vendor's opaque pricing |
| Who your prompts reach | The model provider only, on your account | Vendor's infrastructure |
| Key revocation | Instant, in your control | Request to vendor |
Start with your own keys
Free tier, no card required. Keys are written straight from your browser into encrypted, per-team storage — never through our app servers, never into our logs.