Paitho
BYOK

Your keys.
Your bill.

Paitho routes every LLM call through your own provider keys. We never touch your token bill, and we publish exact usage per draft.

See Pricing Try the Sandbox
Why we built it this way

Trust is a default, not a setting.

01
Trust by default

No black-box markup. Every token shows up on your provider's bill, not ours.

02
Cost transparency

Per-draft token count. Per-vertical model choice. Your own spend caps.

03
Data stays put

Prompt and response only ever touch your provider's account. We see the metadata; they see the content.

04
Easy to leave

Your prompts, your keys, your call history. Export the lot anytime.

Supported providers

Bring whichever model you trust.

A
Anthropic
Claude
O
OpenAI
GPT
G
Google
Gemini
P
Perplexity
Sonar
Gq
Groq
fast inference
OR
OpenRouter
multi-provider
Add a new provider? Open an issue on our GitHub.
Cost calculator

What it actually costs you.

interactive version coming soon

Three real operator profiles, priced at current published rates. Token counts are averages from our own production traffic.

Light operator
Founder, side-channel outbound
~$45 /mo
Volume200 leads/mo
ModelSonnet 4.6
Avg / lead~$0.22
Most operators
Standard
In-house GTM, full pipeline
~$180 /mo
Volume1,000 leads/mo
ModelSonnet 4.6
Avg / lead~$0.18
Heavy / agency
Multi-client, mixed models
~$520 /mo
Volume5,000 leads/mo
ModelSonnet + Flash
Avg / lead~$0.10
Compared to managed credits + 30% margin: you save ~$13–155/mo at these volumes. The margin compounds at higher volume — agencies see the biggest delta.
How keys are stored

Treated like the credentials they are.

Encrypted at rest

AES-256 keychain in your own Postgres. Your BYOK keys are encrypted at rest with pgp_sym_encrypt() using your customer-held PG_PASSPHRASE. Paitho doesn't hold your KMS key — because Paitho doesn't hold your data.

Never logged in plaintext

Every LLM call your Docker makes is tagged with an opaque byok_key_id on stage_runs — plus prompt version, tokens in/out, latency, cost, and the lead it was for. Plaintext keys never appear in logs, dumps, or traces. Your spend is yours to audit; Paitho's operations stack architecturally cannot see it.

Spend caps + alerts

Your spend caps — scope by provider, brand, lead-type, or user. Daily, weekly, or monthly thresholds. Warn or hard-block. Pipeline pauses gracefully when you hit a ceiling.

Switching modes

You don't have to pick one.

BYOK
Your keys. Your bill.

Add Anthropic, OpenAI, Google, or any supported provider. Paitho routes calls. Your provider invoices you.

  • ▪Zero markup on tokens
  • ▪Per-draft token visibility
  • ▪Best for predictable volume
Managed Credits
One bill. No setup.

Buy a credit pack from Paitho. We handle provider keys, model routing, and cost optimization. You get one invoice.

  • ▪Onboard in 2 min
  • ▪Single invoice, single SOC-2 boundary
  • ▪Best for spiky workloads
Co-exist anytime. BYOK as primary, Credits as fallback. Switch in Settings → Billing.
Side by side

BYOK vs Managed Credits.

Dimension
BYOK
Managed Credits
Per-token cost
at provider rate
at provider rate
Markup
0%
~30% (covers ops)
Setup time
~10 min · provider signup
~2 min · one form
Spend visibility
two dashboards (Paitho + provider)
one dashboard
Provider lock-in
none · swap anytime
we choose models for you
Best for
Predictable, trust-first ops
Trying it out, spiky bursts
FAQ

Operators ask these first.

What happens when my BYOK quota runs out mid-pipeline? +
The pipeline pauses, the queue stays intact, and you get a Slack/email alert with the exact lead it stopped on. If you've configured Managed Credits as fallback, it switches over automatically and notes the swap on every affected draft. Otherwise, you top up your provider account and resume — no lost state.
Can I rotate keys without downtime? +
Yes. Add the new key, mark it primary, and Paitho drains in-flight requests on the old key over the next 60 seconds. Then revoke the old one. Zero failed requests, fully scriptable via the API.
Do you support Bedrock or Vertex? +
Bedrock (AWS) is supported in beta — bring your IAM role and we'll assume it via STS. Vertex (GCP) is on the roadmap for Q3, gated by demand from regulated buyers. If your security team requires it, tell us and we'll move it up.
Will Paitho ever take a cut of my token spend? +
No. The platform fee is the platform fee — it doesn't scale with your token bill. If we ever want to change that, we'd grandfather every existing customer onto the original terms. It's tenet four in our manifesto and it's not negotiable.
What about audit logs for SOC2? +
Every key event — created, rotated, revoked, used, capped — is in the audit log, exportable to S3 or your SIEM via webhook. Retention is 365 days on Agency, 90 days on Platform. See /security for the full controls list.
Can I see the exact prompt before it's sent to my key? +
Yes. Turn on "dry-run mode" and Paitho writes every prompt to your dashboard with a "send" button instead of forwarding it. Useful for prompt review, compliance approval, and the first week of any new pack while you're getting comfortable.

Start with Managed Credits.
Switch to BYOK when you're ready.

Either way, you only ever pay what the model costs. We just remove the markup.

See Pricing Try the Sandbox