Use case
It's the question finance, an auditor, or a customer's procurement team eventually asks: how do we know your AI cost records are the whole picture and nobody edited them? A dashboard total can't answer it. Numbers in a dashboard are just rows in a database — rows can be updated, deleted, or quietly back-dated, and a screenshot of a total proves nothing about what's behind it.
For cost allocation, COGS sign-off, or any compliance review, you don't need a prettier report. You need a record you can demonstrate wasn't tampered with.
The moat
Every AI request metered by TOLVYN writes one entry to an append-only ledger. The ledger is built so that any change to a past record is detectable — not as a policy, but cryptographically.
Metered is the boundary, and it is a feature. A request that never reaches the proxy is never recorded — TOLVYN attests only to what it actually saw and charged. That is what makes the ledger a measuring instrument rather than a claim: because it holds exactly the spend your governance layer saw, subtracting it from the provider's invoice leaves the spend it did not. That subtraction is reconciliation, and the shortfall it exposes is shadow AI — spend on your provider keys that bypassed your controls entirely.
Every ledger record is hash-chained (SHA-256) and signed with HMAC-SHA256 using a server-side signing key. Sequence numbers are allocated under a Postgres advisory lock per tenant — no gaps and no duplicates at the moment records are written, even under concurrent writes. (Allocation is what that guarantees. Records removed later by your plan's data retention window are gone, and a chain whose oldest records have aged out simply starts at a higher sequence number.) Each entry is written in the same database transaction as the request it accounts for, so at the moment of writing, a metered request and its ledger entry commit together or not at all. (That is what the shared transaction guarantees. Two things it does not. Retention breaks the pairing: the nightly sweep deletes from the ledger and from the request records as separate statements, so a one-to-one match does not survive a record ageing out of your window. And a ledger entry attests that a request was metered, not that it completed: a response stream cut partway through — by a provider reset or a timeout — is metered on the bytes that arrived and produces an entry indistinguishable from one that ran to completion.)
Because each record's hash includes the previous record's hash, altering any single entry breaks the chain from that point forward — and the break is detectable at the exact record where it happened.
Re-derive and check any range of the chain with one command. Verification recomputes every record hash and HMAC signature, confirms each links to the previous record, and pinpoints the first record that doesn't verify if anything was touched.
# Verify any range of your tenant's ledger
$ tolvyn ledger verify
✓ hash chain intact
✓ all HMAC signatures valid
✓ no sequence gapsYou can also export the full ledger to CSV for your own records, your auditor, or your data warehouse.
tolvyn ledger verify — it reports the first record that fails, or confirms the range is intact.This turns "our dashboard says we spent $X" into evidence a finance team or auditor can actually rely on. Instead of trusting a number, they can verify the record behind it — and you can hand them a ledger export plus a verification they can re-run themselves.
The ledger gives you the audit evidence you use for your own compliance, cost-allocation, and finance reviews. It is a verifiable record of what was spent — not a certification that TOLVYN holds on your behalf.
One limit worth stating plainly, because the question at the top of this page has two halves and verification only answers one of them. Verification proves the records you hold were not altered and that they follow one another in an unbroken chain. It cannot prove the set is complete — a record removed from the very start of a chain leaves no gap between two survivors, only a chain that begins later than it once did. Requests that never passed through the TOLVYN proxy never entered the ledger at all. The verifier we ship says the same thing in its own output, and we would rather you read it here first than discover it in front of an auditor.
To be precise: TOLVYN is not SOC 2 or ISO certified yet (we're targeting SOC 2 Type I in late 2026). We don't claim a compliance badge we haven't earned. What we provide is the tamper-evident ledger and on-demand verification on every plan; CSV export of the ledger from Starter up; and, on Scale and Enterprise, a signed evidence package containing the records, a signed manifest, and a standalone verifier your auditor runs themselves without holding any secret of ours. That is the raw evidence your auditors and finance team work with directly.
Start metering today and every request you route through TOLVYN lands in your ledger from the first call. Free to start — 10,000 requests a month, no card required.