Security
Where your cost data lives and what Costfluent can reach
Costfluent was founded and is built in Frankfurt am Main. Core application services and primary datastores are hosted in Germany, and encrypted recovery backups are kept in the EU. Edge traffic, product email and parts of the cloud connectors run with further providers.
The list of sub-processors names every provider that processes customer data, with what it does and where: Sub-processors
Revocable read-only access
What the connections can and cannot reach
Costfluent can read
Granted- AWS billing and cost-management data for connected accounts
- Azure billing and cost-management data for connected scopes
- Google Cloud billing export rows in the BigQuery dataset you share
- Kubernetes node, pod and container usage reported by the cluster agent you install
- Resource identifiers and metadata used for grouping and allocation
Costfluent cannot read or change
Excluded- Workload contents, databases, application logs or payloads
- Customer content, prompts, or model responses
- Infrastructure configuration or deployed resources
- Anything requiring write permission in a connected cloud account
The connection flow shows the provider-specific permissions before access is granted. Native cloud access is read-only, and you can revoke it in the cloud provider at any time. Removing the agent from a cluster stops its reporting.
Google Cloud billing access uses BigQuery Data Viewer on the export dataset you share. This read-only grant does not give Costfluent access to other datasets or permission to change workloads.
The Kubernetes agent has cluster-wide read access to nodes, pods, namespaces and kubelet metrics. It sends node, pod and container identities, resource requests and usage, and pod labels (all by default). Pod annotations and namespace labels are sent only when configured. It cannot change workloads.
Data protection
How stored cost data is protected
Encryption
Data is encrypted in transit. Stored connection credentials and recovery backups are encrypted.
Tenant isolation
Stored cost data is isolated per organization.
Protected credentials
Stored connection credentials are encrypted, and access to them is restricted.
Least privilege
Each connection asks only for the read permissions cost data needs.
Staff access
Costfluent support can read an organization in the product as one of its members sees it: in a session of at most an hour, read only, opened with a stated reason. Every owner of the organization is emailed about each session, and the organization's audit log records it. Running and repairing the service can require infrastructure access, which is logged per person.
Deletion and backups
What happens when an organization is deleted
Deleting an organization removes its live data. Encrypted recovery backups expire on a fixed schedule, so deleted data leaves the last backup within 365 days. Invoices are kept for their statutory retention period.
Certifications
Current certification status
Costfluent does not hold SOC 2 or ISO 27001 certification. This page and the privacy policy describe the controls in place.
Vulnerability reporting
Report a security issue
Report suspected vulnerabilities through the contact page with the affected URL or component and the steps to reproduce. Test only against your own workspace, and do not access other customers' data or disrupt the service. security.txt points to the same page.
Related pages
- Digital sovereignty
A self-assessment against the EU Cloud Sovereignty Framework.
- Privacy policy
How personal data is processed, including website visitors.
- Terms of service
The contract for using Costfluent.
- Contact
Questions from a security or procurement review.
Check the boundaries with your own costs
Start with permanent Free and a read-only AWS, Azure or Google Cloud connection that you control and can revoke.
Permanent Free plan with no time limit