Anomalous spend detection monitors your daily usage and alerts you when spending deviates significantly from your historical baseline. It runs on a scheduled basis and evaluates spend across organizations, teams, and individual API keys.Documentation Index
Fetch the complete documentation index at: https://concentrate.ai/docs/llms.txt
Use this file to discover all available pages before exploring further.
How it works
Each evaluation cycle:- Collects daily spend over the last 30 days
- Separates the baseline from the detection day — yesterday’s spend is the detection day, everything before it is the baseline
- Validates the baseline — the baseline must have enough data points and consistent usage (see Baseline requirements)
- Computes a z-score — measures how many standard deviations yesterday’s spend is from the baseline average
- Compares against your sensitivity threshold — if the z-score exceeds the threshold, an alert is triggered
Configuration
You can configure anomalous spend detection from the Alerts page in your dashboard.| Setting | Description | Options |
|---|---|---|
| Enabled | Toggle the alert on or off | true / false |
| Sensitivity | How sensitive the detection should be | high, medium, low |
| Scope | What entities to monitor | organization, team, user, key |
Sensitivity levels
Sensitivity controls the z-score threshold that must be exceeded to trigger an alert:| Sensitivity | Z-score threshold | What it means |
|---|---|---|
| High | 2.0 | Alerts on smaller deviations — more alerts, fewer missed anomalies |
| Medium | 2.5 | Balanced — catches significant spikes without excessive noise |
| Low | 3.0 | Only alerts on extreme deviations — fewer alerts, may miss smaller spikes |
A z-score of 2.0 means yesterday’s spend was 2 standard deviations above the baseline average. For normally distributed data, this corresponds to roughly the top 2.3% of expected values.
Scope
Scope controls which entities you want to monitor for anomalous spend. This is a per-user setting — organizations and teams do not have their own alert configurations. You choose what to watch, and you receive the alerts. You can select multiple scopes simultaneously:- Organization — monitors total spend across your entire organization. All org admins, owners, and billing members are included as recipients.
- Team — monitors spend per team that you are an owner or admin of within your organization. Each team is evaluated independently.
- User — monitors aggregate spend across all your personal (non-organization) API keys. This covers your personal wallet only — spend billed to an organization wallet is covered by the Organization scope.
- Key — monitors spend per individual API key that you own. Each key is evaluated independently.
If multiple users in the same organization both enable organization-scope alerts, the organization’s spend is only evaluated once — both users are added as recipients of the same alert.
The User and Key scopes both cover personal API key spend. User monitors the aggregate total, while Key monitors each key individually. Enabling both means you could receive an aggregate alert and per-key alerts for the same spend — this is intentional and mirrors the Organization/Team relationship.
Baseline requirements
To avoid false positives, the detection engine requires a meaningful spending baseline before it will fire an alert. Specifically:- Minimum data points — at least 7 days of data in the 30-day lookback window
- Consistent usage — at least 50% of baseline days must have non-zero spend
- Grace period — accounts less than 14 days old are never alerted
- New accounts are given 14 days before alerts activate
- Accounts resuming after a long break (where most of the lookback window is zeros) are not alerted — there is no meaningful baseline to compare against
- Sporadic, low-frequency users will not receive anomalous spend alerts until their usage becomes consistent enough to establish a pattern
Edge cases
Flat baseline (zero variance)
If every day in the baseline has the exact same spend (standard deviation is zero), the z-score cannot be computed normally. In this case, the engine falls back to a percentage-based check: if yesterday’s spend exceeds 150% of the baseline average, the alert fires.Today’s spend is excluded
The detection day is always yesterday, not today. Today’s spend is excluded from both the baseline and the detection value, since the day is not yet complete and partial data would skew the results.Notifications
When an anomalous spend alert fires, you are notified via your configured channels:- Email — includes yesterday’s spend, the baseline average, the percentage increase, and a link to your billing page
- SMS — a shorter summary with the same key figures