On this page
Key takeaways
- With bring-your-own-key (BYOK), the AI calls run on your own provider account, and that provider bills you directly.
- You choose the provider and model, set your own spend limits and can revoke access at any time.
- Your analytics tool no longer resells tokens, so there is no markup on model usage.
- BYOK is one part of privacy. Tenant isolation, access control and read-only connections matter just as much.
What bring-your-own-key means
Most AI tools run model calls on their own account with an AI provider, then charge you for usage inside their subscription. You never see the provider, the model or the real cost.
Bring-your-own-key (BYOK) reverses that. You create an API key with an AI provider such as OpenAI or Anthropic, add it to your analytics workspace, and every AI call the tool makes runs on your account. The provider bills you directly, at their published rates.
DashboardGPT supports bring-your-own-key on every plan, from the free Explore plan to Enterprise. Model usage is billed by your provider, not by DashboardGPT.
Why BYOK matters
Cost you can see
When a tool bundles AI usage into a subscription, you pay for an estimate: the vendor sets a price that covers heavy users and a margin. With BYOK you pay for what you use, and your provider's dashboard shows exactly what each month cost.
For most analytics workloads, a single question uses a small number of tokens. Teams that ask a few hundred questions a month often find the model cost is a small fraction of what a per-seat AI add-on would charge.
Control over the model
You choose the provider and the model. If your company has standardised on one provider, or has a negotiated agreement with one, BYOK lets your analytics tool follow that decision instead of forcing a new vendor relationship.
Control over spend
Providers let you set monthly spend limits and usage alerts on a key. You can create a separate key for analytics, cap it and watch its usage on its own.
Control over access
A key is yours. If you stop using a tool, or need to rotate credentials, you revoke the key at the provider. Access ends immediately, with no support ticket.
What data reaches the AI provider
This is the question security teams ask first. In a conversational analytics tool, the AI model needs enough context to turn a question into a correct query and explain the result. That context typically includes:
- Your question, as you typed it.
- Schema information: table and column names, data types and the semantic profile (for example, "this column is a date", "this is a currency").
- Result data needed for the explanation: for a written insight, the aggregated figures shown in the chart.
What it does not need is your full dataset. The query runs against your data inside the analytics platform; the model sees the question, the structure and the summarised result, not every row.
Before you connect a key, ask your vendor to confirm exactly which of these are sent, for which features.
Is my data used to train models?
Major AI providers, including OpenAI and Anthropic, state that by default they do not use data sent through their commercial API products to train their models. Retention periods and opt-in programmes vary by provider and plan, so check the current data usage policy of the provider you choose.
With BYOK, the agreement that governs your data is the one between your organisation and your AI provider. That is usually the same agreement your security team has already reviewed.
BYOK is one part of privacy
A customer-owned key controls where model calls go. It does not, on its own, protect your data inside the analytics tool. Look for these as well:
| Control | What it protects against | In DashboardGPT |
|---|---|---|
| Customer-owned AI keys | Model calls on a vendor's account, token markup | Every plan |
| Tenant isolation | One customer's data being visible to another | Every plan |
| Secure data processing | Data exposed in transit or at rest | Every plan |
| Workspace access control | The wrong colleague seeing sensitive data | Workspace roles on Team |
| SSO | Unmanaged logins | Enterprise |
| Audit logging | Not knowing who asked what | Enterprise |
| Private or self-hosted deployment | Data leaving your own infrastructure | Enterprise |
Two practical rules help on any plan:
- Connect databases with read-only credentials. The analytics tool should never be able to change your data.
- Share only the columns you need. Upload an export without personal fields, or connect a view that excludes them.
How to set up BYOK in five minutes
- Create an account with your AI provider if your organisation does not already have one, and add billing.
- Create a new API key just for analytics, named so you can recognise it later (for example,
dashboardgpt-analytics). - Set a monthly spend limit and a usage alert on that key or project.
- Add the key in your DashboardGPT workspace settings. It is stored for your workspace only.
- Ask a test question and confirm the call appears in your provider's usage dashboard.
What BYOK costs in practice
Your cost depends on the model you choose and how many questions your team asks. Three habits keep it low:
- Pick the right model for the job. A smaller, faster model often handles routine questions well; keep the largest models for complex analysis if your tool supports routing.
- Ask specific questions. "Revenue by region, last 6 months" needs less back-and-forth than "how are we doing?"
- Watch the usage dashboard for the first month to set a realistic spend limit.
BYOK checklist for security reviews
Share this with your security or IT team when you evaluate any AI analytics tool:
- Which AI providers and models are supported?
- Which data is sent to the model for each feature?
- Is the key stored encrypted and scoped to one workspace?
- Can we revoke or rotate the key without vendor support?
- How is our data isolated from other customers?
- Are database connections read-only?
- Is private or self-hosted deployment available if we need it?