Valid concern. Your provider API key is never stored — it passes through as a header on each request and is discarded immediately. LLMCap only stores token counts and costs per request. No key retention.
LiteLLM is a great option if you're comfortable running infrastructure. LLMCap is for teams who want enforcement without self-hosting or maintenance overhead.