Skip to content
Costframe

Review how Costframe accesses your cloud.

Inspect the reader roles, credential handling and workspace controls before connecting. Billing, resource metadata and optional identity evidence use separate permissions.

Scope a security review

What Costframe asks for

  • Microsoft Azure

    Generally available

    Reader + Cost Management Reader on the subscriptions or scopes you choose

    Owner, Contributor or any write role. No deploy, resize or delete path, and no access to application data.

  • Amazon Web Services

    Private pilot

    A read-only IAM role, protected by an External ID you control

    Mutation APIs, account administration or write remediation, and no claim of parity with Azure.

  • Google Cloud

    Private preview

    Workload Identity Federation, or a restricted service account with access to the BigQuery billing export

    Automatic project changes, guesses where the billing export is incomplete, and claims about services the integration does not read.

What it refuses on every cloud

Contributor, Owner or any write role
Costframe does not request write or update permissions. The Azure, AWS and Google Cloud clients are read-only, so there is no path to modify or deploy a resource.
Storage, database or key payloads
Costframe does not request customer application database contents, file-share payloads or key values. Cost and resource metadata are customer data; optional directory/AVD features can also process configured identity attributes under separate permissions.

How your data moves

From your browser to the provider APIs and back, and where credentials can and cannot appear.

  1. Your browser

    Clerk session, organization from the verified token

    Every request carries a Clerk token. The organization is read from that verified token, never from the request body, so one workspace cannot address another's data.

  2. API

    TLS, connection material encrypted before storage

    Provider credentials you submit are encrypted before they are stored. The API never returns them to the browser.

  3. Job queue

    References and execution context

    Audit jobs carry references and bounded execution/trace context. Provider credentials and decrypted secret values are not audit-job payloads.

  4. Workers

    Decryption in memory, only when needed

    Authorized API, worker and desktop-analytics paths decrypt connection material only for the provider read that needs it.

  5. Cloud provider APIs

    HTTPS, read-only roles

    Workers call provider endpoints over TLS with read-only roles. Results are stored in Postgres behind deny-by-default row-level security.

Controls a security review can check

Credential isolationEncrypted
Connection material is encrypted before storage and decrypted only when an authorized provider read needs it. The web tier never returns credentials to the browser.
Workspace isolationContext-scoped
The organization comes from the verified token on every call, and queries are scoped by it. Row-level security is an extra boundary for public API access, not a substitute for those server-side checks.
No write pathRead-only
The provider packages are built on read-only clients and Costframe has no remediation write path. The least-privilege role on your side remains the final boundary.
PaymentsStripe checkout
Checkout runs through Stripe, which handles payment details under its own processing terms.
Deletion and revocationCustomer-controlled
Connection removal disables the connection and its schedule through the current workflow. Provider-side role, service-principal or federation revocation remains customer-controlled and follows provider propagation and token behavior.
Operator accessAllowlisted
Costframe operators can have read-only, cross-workspace support visibility only through an explicit allowlist. It never includes write access to your cloud.

What Costframe cannot do

These limits come from the read-only roles, not from a setting someone could switch on.

  • Change resource state

    It cannot stop virtual machines, pause clusters, delete snapshots or change scale sets.

  • Touch network or security rules

    It cannot edit security groups, firewall scopes or routing.

  • Deploy or provision

    It cannot deploy nodes, create databases, raise quotas or change pricing tiers.

Security questions

Is Costframe SOC 2 Type II certified?

No. Costframe maps its controls, such as tenant scoping, encrypted connection material and least-privilege access, to common SOC 2 review areas. That mapping is not an audit opinion, attestation or certification.

How is my data deleted?

Use the connection-removal workflow and review its recorded status. Provider-side revocation is separate: revoke the Azure service principal, AWS IAM role, or Google Cloud federation or service account. Propagation and existing token lifetimes can affect when access ends.

Does Costframe read database payloads?

Costframe's supported collection does not query customer application databases or file-share payloads. It reads authorized resource metadata, utilization and billing data. Optional directory/AVD features can process configured person identifiers and attributes; masked names and stable identifiers can still be personal data. Review the enabled sources, grants and processing terms before using those features.

Who do I contact for a formal security review?

Use the contact page to scope a review. Costframe completes security questionnaires and provides architecture detail for enterprise evaluations.