Security
Is FinOps software secure? Here is our posture
CostAnalyst is built to be the lowest-risk tool a finance team can adopt. It never connects to your cloud accounts and never asks for credentials: it reads only the billing export you upload and the SaaS subscriptions you list. We encrypt your data in transit and at rest, and we never move money or change anything in your environment.
In short
Yes. CostAnalyst asks for no role, no access key, no scope and no login. You upload the billing export your cloud already produces (AWS Cost and Usage Report or Cost Explorer CSV, Google Cloud billing export, Azure cost export) and type in your SaaS subscriptions. It cannot see or change anything in your cloud account, cannot move money, and cannot touch your cards. Uploaded data is encrypted in transit and at rest, and you can ask us to delete it at any time.
Security posture
No account access by design, money-neutral on purpose
Every choice below is made so finance can use CostAnalyst without expanding their attack surface or handing anyone the ability to spend.
No access to your accounts
CostAnalyst does not connect to AWS, GCP, Azure or any SaaS admin console. You export the billing file yourself and upload it, and you type in your subscriptions. CostAnalyst cannot resize an instance, delete a resource, or cancel a subscription. It reads the file, it recommends, your team acts.
We never move money
CostAnalyst holds no funds, processes no payments, and stores no card numbers. There is no accounts-payable rail and no checkout. It is an analyst, not an actor, so even a worst-case compromise cannot spend a dollar of yours.
Encryption in transit and at rest
All data is encrypted in transit with TLS and encrypted at rest. Uploaded billing files are never exposed in logs or to other tenants, and there are no cloud credentials stored that could leak.
No credentials at all
There is no connection to scope. We never ask for a cloud role, an access key, a SaaS admin login or a bank login, so there is nothing to rotate and nothing to revoke.
You decide what we see
We see only the exports you choose to upload, and a new upload replaces the old one. Stop uploading and nothing new reaches us; ask support and we delete what you uploaded.
Regional data handling
We are deliberate about where billing and usage data is processed and stored. Enterprise customers can scope data residency and get a security review.
Scope
What we read, and what we never do
What we read
- Cloud billing and usage from the export file you upload (AWS, GCP, Azure)
- SaaS subscriptions you enter yourself: seats, cost, renewal date, owner
- Resource and seat utilization, so we can find idle spend and unused seats
- The account name you upload under and the owner you set, to split spend by account and owner
What we never do
- Move money, pay invoices, or hold funds
- Touch, store, or charge your cards
- Change anything in your cloud account or cancel a subscription
- Ask for a cloud role, an access key, a SaaS admin login or a bank login
CostAnalyst is decision support with no access to your accounts, not financial advice. Every recommendation is for a human on your team to review and act on in your own accounts.
Security questions
The questions finance asks first
Yes. CostAnalyst never asks for cloud credentials, access keys or roles. It works only from the billing export file you upload and the SaaS subscriptions you type in, and it encrypts your data in transit and at rest. To stop sharing data, you simply stop uploading, and you can ask us to delete what you uploaded. See our security page for the full posture.
No. CostAnalyst has no access to your cloud accounts or SaaS tools at all, read or write. It reads the billing export you upload and the subscription list you enter, so it cannot change anything in your environment, resize an instance, or cancel a subscription. It shows you the recommendation, and your team acts.
Never. We do not process payments, hold funds, pay invoices, or touch your cards. CostAnalyst is an analyst: it reads your spend, finds the savings, and shows you the recommendation. Every action happens in your own accounts, by your own team.
No. CostAnalyst is decision-support tooling. Its recommendations are computed from your real usage and billing data, and they are for a human on your team to review and decide. It is not financial, tax, or accounting advice.
More on accuracy, money, and how your data gets in on the full FAQ.
The lowest-risk tool to adopt
Upload your cloud billing export and see your savings in dollars. We never ask for credentials, we never move money, and you can delete your data anytime.