[bartread]

I don't know how you'd enforce that unless it was something you could mandate at the level of the API call, and then the API call is rejected if the customer hasn't configured it for "no transcript".

It sort of feels like an area of friction even still.

[dmurray]

I was thinking of an API key that was scoped both to a specific customer and a specific service provider (perhaps both have to do something to provision it).

Billing goes to the customer, debug logs etc go to the service provider.