Is BYOK (bring your own key) safe for proposal generation?

Safe when keys are AES-256 encrypted in a secrets manager, decrypted only in-memory at call time, never logged, and only used for calls a logged-in user initiated. Real upside is paying providers at list price (~30-50% cheaper than reseller margins) with usage in your own dashboard; downside is you eat surge spend if your team goes wild.