Security
Cloud Spend Guard needs to see inside your cloud accounts to do its job. We ask for as little access as possible, only ever read, and are open about what we store and where.
Read-only access
Cloud Spend Guard never creates, changes, stops or deletes anything in your cloud accounts. Recommendations come with the command to run, and you decide whether to run it.
| Cloud | What you give us | What it can do |
|---|---|---|
| AWS | An IAM role created by a CloudFormation stack you launch and can review first. We assume it from our AWS account with an External ID unique to your Connection. | The AWS managed ViewOnlyAccess policy, plus read access to the Cost Export bucket and export, organization and Resource Explorer lookups, and a permission check on the role itself. |
| Azure | A service principal you create, with its tenant ID, client ID and secret. | The built-in Reader role on one subscription. |
| Google Cloud | A service account key you create in one project. | The Compute Viewer role. |
| DigitalOcean | A personal access token for one Team. | Only the custom read scopes we list. We check each one when you connect. |
On AWS, ViewOnlyAccess lists resources and their configuration but cannot read their contents: not the objects in your S3 buckets, the items in your DynamoDB tables or the values of your parameters and secrets. We chose it over ReadOnlyAccess for exactly that reason.
Your billing data stays in your account
On AWS, the setup creates a Cost Export that AWS delivers to an S3 bucket in your own account. We read it from there with the role above. The bucket is kept if you delete the stack, so you decide when to remove it.
No calls that add to your bill
We pick APIs that are free to call and avoid paid ones such as AWS Cost Explorer. The cost on your side is storing the Cost Export in your bucket, usually a few cents a month.
How we store your data
- Everything runs on AWS in the us-east-1 (N. Virginia) region.
- Tokens, secrets and keys you give us are stored as encrypted AWS Systems Manager SecureString parameters, readable only by the functions that use them.
- Snapshots and account data are encrypted at rest. The buckets that hold your data block all public access, and all traffic uses HTTPS.
- API keys for the MCP server are stored only as a SHA-256 hash. We show the key once, when you create it.
- When you delete a Connection, its stored token, secret or key is deleted with it.
Sign-in and payments
- Sign-in is handled by Amazon Cognito, with email and password or your Google account.
- Payments are handled by Stripe. Your card details go to Stripe and never reach our servers.
Sam, the AI assistant
Sam runs on Amazon Bedrock in our own AWS account. It reads the same data you see in Cloud Spend Guard and cannot change anything in your cloud accounts. AWS states that Bedrock does not use prompts and responses to train models or share them with model providers.
Reporting a vulnerability
If you believe you have found a security issue, email security@cloudspendguard.com with the details and steps to reproduce it. Please give us a reasonable time to fix it before making it public. We will reply, keep you updated, and credit you if you wish.