Valid concern. Your provider API key is never stored — it passes through as a header on each request and is discarded immediately. LLMCap only stores token counts and costs per request. No key retention.