Security, read-only cloud access, and regional data residency by design.

CostGlass connects with read-only permissions by default, keeps only the billing and usage data it needs, and lets you choose where your data is held.

Security, Trust & Compliance Architecture

Enterprise-Grade Security with Zero Customer Data Ingress

CostGlass is engineered for enterprise multi-cloud teams requiring strict operational security across AWS, Azure, Google Cloud, OCI, Alibaba, DigitalOcean, Linode, Cloudflare, and Kubernetes. We never ingest your application data, database contents, or source code.

Commitment to ISO/IEC 27001 StandardsActively Working Towards Certification

We design, maintain, and govern our systems strictly according to the ISO/IEC 27001 Information Security Management System (ISMS) framework. While we are currently non-certified, we are actively implementing full controls, continuous vulnerability management, and audit trails to achieve formal ISO 27001 certification.

Data Isolation Architecture

What CostGlass Accesses vs. What We Never Touch

Our least-privilege architecture guarantees your sensitive business and customer data never leaves your cloud perimeter.

What CostGlass Ingests (Cost & Metadata Only)

  • ✓Billing Line Items: Multi-cloud FOCUS 1.0 exports, AWS CUR 2.0, Azure Cost Management exports, GCP BigQuery billing, OCI/Alibaba/Cloudflare cost feeds.
  • ✓Resource Metadata: Instance/VM IDs, SKU types, volume sizes, network IDs, and Kubernetes cluster/namespace names.
  • ✓Resource Tags & Labels: Cost allocation tags, environment labels, squad IDs, and owner labels for virtual allocation.
  • ✓Aggregated Utilization Metrics: Average CPU %, memory %, and network I/O used solely for rightsizing suggestions.

What CostGlass NEVER Accesses

  • ✕Customer Application Data: We never inspect object storage contents, files, messages, user documents, or runtime memory.
  • ✕Database Records: Zero read or write access to SQL/NoSQL databases, data warehouses, tables, or row data.
  • ✕Source Code & Prompts: No access to your Git repositories, container images, or LLM prompt/completion payloads.
  • ✕Customer Secrets & Keys: Zero access to your KMS private keys, Key Vaults, Secret Managers, or customer credentials.
Compliance Roadmap

Our Journey Towards ISO/IEC 27001 Certification

Transparency is our core principle. Here is the concrete roadmap our engineering and security teams are executing.

Phase 1 · Complete

ISMS Scope & Policies

Established Information Security Management System boundary, organizational risk assessment, and core security governance policies.

Phase 2 · Complete

Technical Safeguards

Enforced TLS 1.3 across all endpoints, automated dependency scanning, multi-factor authentication (MFA), and encrypted backups.

CURRENT PHASE
Phase 3 · In Progress

Control Validation

Implementing Annex A operational controls, role-based access reviews, business continuity drills, and third-party penetration tests.

Phase 4 · Roadmap

Formal Audit & Cert

Engaging an accredited third-party certification body for Stage 1 documentation review and Stage 2 formal certification audit.

Least-Privilege Authorization

Read-Only Multi-Cloud Delegation & IAM Policy

Every supported cloud connects via least-privilege read-only delegation—Google Workload Identity Federation, Azure Cost Management Reader consent, AWS STS AssumeRole with External ID, and scoped read-only tokens. Inspect our exact AWS IAM policy below:

Operational Controls

How We Protect Platform & Ingested Metadata

TLS 1.3 & AES-256 Encryption

All network traffic is encrypted using TLS 1.3 with Perfect Forward Secrecy. Database volumes and analytical caches are encrypted using AES-256 with customer-isolated keys.

Vulnerability Management

Continuous automated static analysis, container image scanning (Trivy), and automated dependency alerts ensure vulnerabilities are patched before reaching production.

Private VPC / Self-Hosted Option

Enterprise customers requiring complete sovereign network boundary control can deploy the CostGlass platform directly inside their own private cloud VPC using our Terraform module.

Frequently Asked Security Questions

Clear answers to common questions from enterprise SecOps and IT procurement teams.

We are currently NOT formally certified under ISO 27001 or SOC 2, but we are actively working towards ISO/IEC 27001 certification. We already operate under strict information security management policies, rigorous access controls, TLS 1.3 encryption, and automated vulnerability scanning.

Have a Specific Security Requirement or Procurement Question?

Our security and infrastructure engineering team is available to review architecture diagrams or complete custom vendor questionnaires.