Find the methods, provider permissions and supporting documents for your security review. Provider access is read-only. Costframe makes no certification claim; coverage still in development is identified below.
Select a topic to inspect its conceptual data flow and review limits.
Outside Costframe: Provider write clients
Billing, inventory, metrics, and recommendation APIs are used only where configured and permitted.
Costframe requests provider read roles for cloud analysis. The product does not deploy, resize, delete, or mutate customer resources; remediation stays in the customer's own change process.
Provider data enters through read-only clients and becomes organization-scoped evidence.
Read the supporting document ↗Cloud credentials are treated as sensitive connection material. The configured credential-encryption path protects stored material; workers decrypt it only as needed for provider reads.
Connection removal disables the connection through the current workflow; provider-side credential revocation remains customer-controlled.
Read the supporting document ↗Findings expose checked evidence, unavailable evidence, freshness, confidence, contradiction state, owner, approval, and verification context.
A missing signal is a visible limitation, not hidden certainty.
Read the supporting document ↗Azure is generally available. AWS is a private pilot and Google Cloud a private preview. Evidence coverage depends on the validated provider scope and permissions.
Provider pages and docs carry readiness language instead of implying parity or certification.
Read the supporting document ↗Application data is scoped by verified organization context. Cross-tenant administrative visibility is reserved for explicitly allowed platform-admin read-only paths.
Every user-facing query should derive organization context from verified auth, not request body input.
Read the supporting document ↗Authorized CSV exports preserve financial basis, native currency and evidence limits. General audit PDF is unavailable during controlled launch; AVD formats and internal statements have separate scope and access.
Reports should not label estimated savings as verified realized savings.
Read the supporting document ↗Deletion and retention follow the documented product workflow and applicable legal, billing and security requirements. Request status remains distinct from verified completion.
Retention and deletion behavior should be reviewed in docs and contracts before stronger claims are made.
Read the supporting document ↗Audits, reports, findings, and delivery events keep timestamps and state so teams can review what happened. These logs are operational records, not cryptographically immutable ledgers.
The audit outcome, report generation state, and export state are separate truths.
Read the supporting document ↗Unsupported providers, stale evidence, missing metrics, incomplete billing exports, and features still in development must remain visible.
The limitations page is part of the trust story, not a footnote.
Read the supporting document ↗Remediation remains in the customer's change process. Guidance and requests do not certify implementation or a verified outcome.
No provider-write guarantee remains the boundary for public trust copy.
Read the supporting document ↗