Trust Center
This Trust Center is deliberately conservative: no invented certifications, no fake screenshots, no autonomous remediation promises, and no hidden provider-write path.
Read-only trust boundary
Read APIs, billing exports, inventory, metrics
Org-scoped records, evidence freshness, detector inputs
Checked signals, missing signals, confidence, price math
Tickets, reports, and guidance leave Costframe for human approval
Evidence Ledger
The marketing pages now distinguish real product captures from conceptual diagrams. The Evidence Ledger story mirrors the app: what was checked, what was missing, and who must approve the action.
Evidence checked
CPU history, cost line item, resource state, SKU catalog reference
Evidence unavailable
Missing metric windows, unsupported provider fields, stale billing exports
Decision state
Confidence, contradiction checks, owner, approval status, verification plan
Interactive architecture diagrams
Hover, focus, or tap a diagram. Motion is restrained and respects reduced-motion settings.
Billing, inventory, metrics, and recommendation APIs are used only where configured and permitted.
Trust inventory
Costframe requests provider read roles for customer cloud analysis. Public copy must not imply that Costframe can deploy, resize, delete, or mutate customer resources.
Proof: Provider data enters through read-only clients and becomes org-scoped evidence.
Cloud credentials are treated as sensitive connection material. Secrets are encrypted at rest and decrypted only where the worker needs them for provider reads.
Proof: Connection removal must remove stored credentials according to the product retention model.
Findings expose checked evidence, unavailable evidence, freshness, confidence, contradiction state, owner, approval, and verification context.
Proof: A missing signal is a visible limitation, not hidden certainty.
Azure is the most mature provider path. AWS and Google Cloud remain readiness-gated where billing exports, inventory, or metrics are not yet verified.
Proof: Provider pages and docs must carry readiness language and limitations.
Application data is scoped by verified organization context. Cross-tenant administrative visibility is reserved for explicitly allowed platform-admin read-only paths.
Proof: Every user-facing query should derive organization context from verified auth, not request body input.
Exports are evidence artifacts for customer review. CSV and PDF outputs must preserve estimation, verification, and limitation language.
Proof: Reports should not label estimated savings as verified realized savings.
Public trust copy must stay conservative unless backed by the current product retention policy and legal terms.
Proof: Retention and deletion behavior should be reviewed in docs and contracts before stronger claims are made.
Audits, reports, findings, and delivery events should keep timestamps and state so teams can reconstruct what happened.
Proof: The audit outcome, report generation state, and export state are separate truths.
Unsupported providers, stale evidence, missing metrics, incomplete billing exports, and readiness-gated features must remain visible.
Proof: The limitations page is part of the trust story, not a footnote.
Future remediation and workflow features stay customer-approved and evidence-backed. Public pages must not promise autonomous cloud changes.
Proof: No provider-write guarantee remains the boundary for public trust copy.