Skip to main content
This page is for security and procurement reviewers. It describes how CostGraph Cloud authenticates people and machines, keeps organizations apart, handles the credentials you give it, and what data it collects. For an install that keeps your data in your own network, see Self-hosted.

​
Infrastructure

CostGraph Cloud runs on AWS, and your data is hosted in the us-east-2 region. The app and API are served over HTTPS. Database storage is encrypted at rest with AWS KMS.

​
Sign-in

People sign in with one of:
  • Email and password. Passwords need at least 8 characters, with upper and lower case letters, a number, and a symbol. People can add an authenticator app as a second factor under their account’s Security settings.
  • Google.
  • Your identity provider through SAML or OpenID Connect single sign-on. Owners can require single sign-on for everyone with an email address at a verified domain.
SCIM provisioning lets your identity provider create and deactivate members, and map groups to roles.

​
Access control

Every member has a role: owner, admin, billing admin, or member. See Roles and permissions for what each one can do. An organization holds one or more tenants. Every request that reads or changes tenant data names the tenant, and CostGraph checks that the caller can access it before it runs. An API key or app token is bound to one tenant and can’t reach another.

​
Machine credentials

  • API keys carry scopes and act with their creator’s current role. CostGraph stores a keyed hash of each key, never the key itself, and shows only its last four characters. A key can have an expiry date.
  • Apps that use Sign in with CostGraph get tokens limited to the scopes the person approved. App tokens can’t manage API keys, single sign-on, or alert destinations.
  • SCIM tokens are stored as hashes and shown once.

​
Integration credentials

When you connect a provider, CostGraph prefers access that doesn’t need a long-lived secret:
  • AWS: an IAM role that CostGraph assumes with an external ID. Access keys are also accepted.
  • Google Cloud: workload identity federation. A service account key is also accepted.
Secrets you enter, such as API tokens and keys, are encrypted with AES-256-GCM before they’re stored, and each one is bound to its own connection. The API never returns a stored secret.

​
What CostGraph collects

CostGraph collects cost and usage data, not your application data. The operator’s cluster role lists the Kubernetes resources it can read. Secrets, ConfigMaps, and service accounts aren’t on that list, so the operator can’t read them.

​
Support access

CostGraph support can view your organization only with your consent. An owner or admin grants support access for a set period, from 1 to 168 hours, and can revoke it at any time. While access is granted, support sessions are read-only: any request that would change something is refused. Each session lasts at most 30 minutes, every request is recorded in your audit log, marked CostGraph support, and the organization owner is notified.

​
Data deletion

Organization data is deleted on request. The request must come from the organization owner’s registered email address, and the deletion is completed within 30 days of the request. Deleting an organization in the app closes it: the organization is deactivated and no one can sign in to it. Its data is deleted when the owner requests deletion. Deleting a Graph AI chat deletes it permanently. Database backups are kept for 7 days.

​
Audit log

The audit log records sign-ins, role and API key changes, support access, and every change and export. Entries are kept for one year. Owners and admins can read it in the app, export it as CSV, or read it through the API.

​
Self-hosted

Self-hosted CostGraph runs in your own infrastructure, on a database, cache, and metrics store you operate. Your cost data, resource inventory, and metrics stay in your network. What leaves is your licence status, aggregate billing quantities, and requests for public cloud prices. Support access isn’t available on self-hosted installs.