Main content

Security & compliance

Enterprise-grade
trust & security

The Varcio platform is built with security at every layer — from credential encryption to immutable audit trails and SOC 2 readiness.

Credential handlingMixed trust
[system] Initiating AssumeRole...
[aws-sts] Validating trust policy
AWS token issued / Azure-GCP secrets remain encrypted
Cross-account authNo plaintext exposure
Data securityTLS 1.3
AES-256

All database volumes, snapshots, and backups are encrypted at rest using KMS.

At restIn transit
Compliance statusMapped
SOC 2 Ready

Controls aligned to CC1–CC9, certification in progress

SecurityAvailabilityConfidentiality
SOC 2Readiness
99.9%Uptime SLA
AES-256Encryption at rest
TLS 1.3Data in transit
0Plaintext secrets

Security by design, not afterthought

Four foundational principles guide every architectural and product decision.

Zero trust by default

No implicit access. Every API call is authenticated, authorized, and rate-limited.

No plaintext secrets

AWS uses AssumeRole, while Azure, GCP, and OCI credentials are encrypted at rest and never exposed in logs, API responses, or the UI.

Immutable audit trail

Every action, decision, and data access is logged with actor, timestamp, payload, and outcome. Logs cannot be modified or deleted.

Defense in depth

Multiple independent security layers — authentication, authorization, execution safety, rate limiting, and protected resources.

Four layers around every cost action

Credentials never sit in plaintext, permissions are scoped twice, and no write reaches a resource without a human approving it.

Layered security model around every cost actionFour nested layers protect any write action: provider-native trust, encrypted credential storage, dual-layer role-based access control, and a required human approval gate at the centre.Provider-native trustAssumeRole · SP · SA JWTEncrypted credentialsAES-256 at rest · TLS 1.3Dual-layer RBACpage + action permissionsApproval gatehuman sign-off requiredProtected tags keep critical infrastructure out of scope entirely
Each layer narrows what an action can reach — with the human approval gate at the centre.

From finding to action, fully audited

Detection is automated. Action never is — every remediation clears policy and a named approver first.

Approval-gated remediation pipelineA finding moves through detection, scoring, policy evaluation, human approval in Slack or Teams, and finally execution — with every step written to an immutable audit log.Detect305 detectors1Scoresavings · risk2Policyadvisory / block3ApproveSlack or Teams4Executeprotected tags5HUMAN GATEImmutable audit log — actor, timestamp, and payload recorded at every step
Actor, timestamp, and payload are recorded at every step for SOC 2 evidence collection.

How your data moves through the platform

From connection to action — every step is encrypted, audited, and gated.

  1. Connect

    Provider-native trust models with no plaintext credential exposure

    AWS: AssumeRole with ExternalID. Azure: encrypted Service Principal. GCP: encrypted Service Account JWT. OCI: native credential flow.

  2. Ingest

    Cost data pulled via official cloud APIs

    AWS Cost Explorer, Azure Cost Management API, GCP BigQuery billing export — always read-only.

  3. Process

    Data normalized, analyzed, and stored encrypted

    Cost metadata is encrypted at rest, encrypted in transit, and processed inside isolated application environments.

  4. Act

    Remediation requires human approval

    Write operations gated by approval workflow. Protected tags exclude critical resources. Rate limited to 10 actions/min.

9 security control layers

Every layer of the platform is designed with defense-in-depth principles.

Access

Authentication

JWT sessions, OAuth (Google, GitHub, Azure AD), SSO via OIDC and SAML 2.0, SCIM provisioning (Enterprise)

Access

Authorization

Dual-layer RBAC: page permissions (navigation) + action permissions (operations)

Data

Credential storage

Fernet symmetric encryption (AES-128-CBC + HMAC-SHA256) — zero plaintext persistence

Access

API tokens

SHA-256 hashed, show-once creation, configurable expiry, instant revocation

Runtime

Execution safety

Single-use JTI tokens, replay prevention, approval gates for all write operations

Integration

Webhook signing

HMAC-SHA256 per-subscription signing secrets

Runtime

Rate limiting

Per-IP and per-route limits with elevated thresholds for compute-heavy endpoints

Compliance

Audit trail

Immutable action and decision logging with actor, timestamp, and payload details

Compliance

Compliance

Control-mapped findings across SOC 2, CIS, NIST, and ISO 27001 with one-click evidence export

Encryption at every layer

LayerMethodScope
Data at RestAES-256 encryptionAll database fields and stored files
Data in TransitTLS 1.3All API calls, webhooks, and integrations
CredentialsFernet (AES-128-CBC + HMAC-SHA256)Cloud connection credentials
API TokensSHA-256 hashUser and service API tokens
Webhook SignaturesHMAC-SHA256Per-subscription signing secrets

Provider-specific trust models

AWS, Azure, GCP, and OCI are handled differently, but every path avoids plaintext exposure and keeps execution behind approval gates.

ProviderMethodHandling
AWSIAM AssumeRoleNo static access keys required or stored
AzureEncrypted Service PrincipalStored encrypted, never exposed in logs or UI responses
GCPEncrypted Service Account JWTStored encrypted, never exposed in logs or API payloads
OCINative OCI credential flowSame no-plaintext-exposure standard as every other connected provider
ExecutionApproval-gated write pathAll remediations and purchases require explicit approval before live execution

Dual-layer RBAC

Page-level visibility and action-level permissions — independently configurable per role.

RolePagesActionsDescription
ViewerDashboard, FindingsView-onlyRead-only access to cost data and findings
AnalystAll except AdminScan, Query, ForecastRun analyses but cannot execute changes
OperatorAll except AdminScan, Query, Approve, RemediateFull operational capabilities within team scope
AdminAll pagesAll actions + SettingsWorkspace management, API keys, integrations

SOC 2 readiness framework

Coverage across all 9 Common Criteria (CC1–CC9) with built-in compliance controls.

CC1Ready

Control Environment

RBAC, role definitions, organizational policies

CC2Ready

Communication & Information

Audit trails, user notifications, system alerts

CC3Ready

Risk Assessment

Risk scoring, anomaly detection, policy evaluation

CC4Ready

Monitoring Activities

Real-time monitoring, health checks, uptime tracking

CC5Ready

Control Activities

Approval gates, execution safety, rate limiting

CC6Ready

Logical Access

JWT auth, OAuth, API token hashing, credential encryption

CC7Ready

System Operations

Event bus, webhook delivery, outbox pattern

CC8Ready

Change Management

PR analysis, policy enforcement, configuration auditing

CC9Ready

Risk Mitigation

Protected tags, dry-run mode, dead-letter queues

How we compare

The only option in this comparison that combines AI operations, commitment purchasing, policy enforcement, and governed remediation in one product.

Scroll sideways to see every column.

CapabilityCloudHealthInfracostKubecostVarcio
Multi-Cloud Spend
Pre-Merge PR Analysis
K8s Cost Attribution
AI Conversational Interface
Automated Remediationlimited
Commitment Purchasing
Predictive Forecastingbasicbasic
ChatOps Approvals
Event Bus / Webhookslimited
Policy Enginebasicbasic
Starting Price$$$$Free (limited)Free (limited)$49/mo

Security FAQs

Does Varcio store our cloud credentials?

AWS uses IAM AssumeRole, so no static access keys are stored. Azure and GCP credentials are stored encrypted at rest using Fernet and are never exposed in logs, API responses, or the UI.

What data do you access?

Only cost and usage metadata. We read from Cost Explorer, Cost Management API, and BigQuery billing exports. We never access your application data, logs, or secrets.

Can auto-remediation break production?

We have multiple safety layers: protected-tag exclusion, human approval gates, rate limiting (10 actions/min), and dry-run mode. Critical resources tagged as protected are never touched.

Are you SOC 2 certified?

We built the platform for SOC 2 readiness from day one, with controls mapped to all 9 Common Criteria (CC1–CC9). The Compliance module maps findings across SOC 2, CIS, NIST, and ISO 27001 with one-click evidence export. Formal certification is in progress.

How do you handle data residency?

Cost data is processed and stored in the region you choose during onboarding. Enterprise plans support custom data residency requirements.

What happens if you have a breach?

Because AWS uses AssumeRole and Azure/GCP credentials are encrypted with strict exposure controls, the blast radius is limited to cost metadata and approved execution paths. Incident response, notification, and immutable audit trails support forensic review.

Secure. Compliant. Ready.

Start your free trial with enterprise-grade security from day one.