You own the proof. We share the savings you can verify without trusting us.
Most vendors publish a price. We publish a structure, because for an attester the structure is a trust property before it is a commercial term.
How we charge
Commercial deployments pay a savings-share: a percentage of savings that were attester-signed — and our invoice carries its own cryptographic proof. The pilot fee is fixed and credited in full against conversion. Federal, air-gapped, and grant-funded deployments use flat per-gateway licensing instead, sized to appropriated and granted budgets.
The plain consequence of the structure: if the sealed ledger shows no savings, the share is zero. We don’t ask you to fund an outcome that didn’t occur.
Two things worth paying for, priced the way each earns its keep
Verification is worth having on day one — before a single dollar is optimized — because an independently signed record of your AI spend is valuable on its own. Optimization is worth sharing, because that’s upside we create together. So we price them the way each actually delivers:
- The gateway, the independent attester, sealed records, and the offline verifier your auditors run themselves
- Compliance-ready evidence: exceptions reporting, an audit recompute workflow, and provider-invoice reconciliation
- Fully valuable at zero measured savings — you are paying for proof, and the proof stands on its own
- A percentage of savings that were attester-signed — and only those
- Computed at the rate card pinned on day one — a provider price cut is yours, not ours
- If the sealed ledger shows no savings, the share is zero. Our incentive and yours point the same way
- Every share invoice carries the record it is computed from, for you to recompute
The result is alignment without a hostage: you own verification outright, and you only share what we genuinely helped you save.
The question you should ask
A fee computed from a savings figure invites an obvious objection: doesn’t the party signing the number now have a stake in the number? Yes — which is why the architecture removes our ability to move it. The trust doesn’t come from our disinterest. It comes from your ability to check.
- The baseline method is hash-pinned and agreed before deployment — it cannot drift toward a bigger savings figure mid-term
- The computation is deterministic: same ledger, same baseline, same result — every time, for anyone
- Your auditors recompute every claim with the offline verifier, on your hardware, without trusting us
- Every quantity carries its basis flag — independently verified, or provider-asserted — and the statement discloses the mix
- Alter a hash-pinned baseline during a term — the method you agreed to is the method you’re billed on
- Invoice a share on figures that fail verification — if it doesn’t verify, it isn’t billed
- Invoice a share on a market price cut — savings are computed at the rate card pinned at go-live, never at whatever the market did since
- Accept compensation from your AI vendors, routers, or optimization providers on records we attest
Savings are measured at constant rates
Token prices are falling. Between May and September 2026 the benchmark price of a million tokens fell by roughly half, and providers have announced further cuts. That is good for you, and we take no part of it.
We pin your rate card on day one and seal it into the record. Every savings figure we report is computed at those pinned rates. If your provider cuts prices tomorrow, your bill falls and our share does not move. If your provider raises prices, the same holds in reverse. What we are paid on is quantity: fewer tokens consumed for the same unit of work. Routing changes what a token costs. We change how many you need. Those are different things, and we will not invoice you for one while claiming the other.
- Savings at pinned rates — the billable line
- Market rate movement over the same period — informational, never billable, and labeled as such
- The pin date and the hash of the sealed rate card, so both lines are recomputable by you or your auditor without us
- A provider change or renegotiation re-pins the card by written agreement, with a new pin date
- Every card, superseded and current, stays in the record and stays verifiable
- No period is ever recomputed at a later card
Our own invoices carry their own seal
Every TokenMark™ invoice ships with the attested record it is computed from — the same artifact, the same verification path we provide for your AI spend. Disagree with our bill? Run the verifier. The number can’t be argued with — in either direction. That cuts against us exactly as often as it cuts for us, and that symmetry is the point.
Our fee is tied to the number. The number is not ours to move. That trade is the product.
What things cost
Subscription tiers, the share percentage, and flat-license terms are scoped per deployment — gateway count, environment, edition, and term — and shared in writing during the pilot conversation, under NDA. We publish the structure here because the structure is the commitment; the numbers are ordinary, and yours on request.