Skip to content
CostReveal
Menu

Security

Built for the security review, not around it.

How CostReveal isolates your data, limits who can reach it, and proves what happened. Every statement on this page describes the running system.

Tenant isolation in the database

  • Every organization is separated by PostgreSQL row level security, forced on every table that holds customer data.
  • The application connects as a role that is never a superuser, never bypasses row level security and never owns the tables. The service verifies this each time it starts and refuses to run otherwise.
  • Work across organizations, such as scheduled retention, runs in a separate system scope that each use must name, never under a customer’s identity.

Reading your providers, and only reading

  • CostReveal asks for billing and usage data only, through each provider’s own mechanism. For AWS that is a read only role with an external ID unique to your organization, which cannot create, change or delete anything.
  • OpenAI and Anthropic reach cost reports only through an Admin API key, which neither lets you limit to reading. CostReveal says so before asking for one, only ever reads with it, and never shows it again once entered.
  • Provider credentials and identity provider certificates are encrypted with AES-256-GCM before they are stored, under keys that can be rotated without downtime.

Authentication

  • Passwords are hashed with Argon2id and checked against a length based policy, as NIST SP 800-63B recommends.
  • Two step verification with an authenticator app, and single use backup codes, which an organization can require of every member.
  • CostReveal staff cannot open the system console, or inspect an organization, without two step verification.
  • SAML single sign on for Enterprise organizations, limited to your verified company domain, with signed assertions required, single logout, and the option to require it of everyone on the domain but owners.
  • Access tokens last ten minutes. Refresh tokens rotate on every use, and a reused token ends the whole session as theft.
  • Every person can see their active sessions and end any of them.

Least privilege inside your organization

  • Owners, admins, members, viewers and billing roles, each with a fixed set of permissions.
  • Members and viewers see only the projects they are granted.
  • Role and access changes apply on the very next request, not at the next sign in.

Audit trail

  • Invitations, role changes, access grants, settings changes and sign in events are recorded as they happen.
  • The audit log is append only: the application can add entries but cannot edit or delete them.
  • Entries are kept for 90 days, or 365 days on Enterprise.

Staff access

  • CostReveal staff can see an organization only through an inspection that states a reason.
  • Inspections are read only for their whole duration and are recorded in a separate staff audit trail.

Operations

  • Every minute, CostReveal checks that its figures can be trusted: ingestion, the ledger's guarantees, attribution, reconciliation, exchange rates and mail.
  • When a check stops being healthy, CostReveal staff are alerted by email and Slack at once, again if it worsens, and when it recovers, and each incident is kept.
  • Every service's log is kept in Oracle Cloud's logging service, apart from the server it ran on.
  • Every change is checked against published security advisories, and none is made while a high or critical one is open in what CostReveal depends on.

Your data, your control

  • Every person can export the personal data CostReveal holds about them, and erase their account.
  • Sessions are removed 30 days after they end, and expired sign in links after 7 days.
  • Requests from the demo form are deleted after a year.

Compliance

Where we are, stated plainly.

CostReveal does not yet hold a SOC 2 report or an ISO 27001 certificate. We are glad to complete your security questionnaire, walk your team through the controls above, and sign a Data Processing Agreement.

Read the Data Processing Agreement

Report a vulnerability

If you believe you have found a security issue, write to security@costreveal.com with the steps to reproduce it. We acknowledge every report, keep you informed while we fix it, and will not take action against research done in good faith that avoids other customers’ data and service disruption.

Start with your own numbers.

Connect a provider, read only wherever it allows, and see your spend attributed, with the basis on every figure. The first 7 days are free.

Get startedBook a demo