Enterprise-Grade
Trust & Security
FinOps Co-Pilot is built with security at every layer — from credential encryption to immutable audit trails and SOC 2 readiness.
Security by Design, Not Afterthought
Four foundational principles guide every architectural and product decision.
Zero Trust by Default
No implicit access. Every API call is authenticated, authorized, and rate-limited.
No Plaintext Secrets
AWS uses AssumeRole, while Azure and GCP credentials are encrypted at rest and never exposed in logs, API responses, or the UI.
Immutable Audit Trail
Every action, decision, and data access is logged with actor, timestamp, payload, and outcome. Logs cannot be modified or deleted.
Defense in Depth
Multiple independent security layers — authentication, authorization, execution safety, rate limiting, and protected resources.
How Your Data Moves Through the Platform
From connection to action — every step is encrypted, audited, and gated.
Connect
Provider-native trust models with no plaintext credential exposure
AWS: AssumeRole with ExternalID. Azure: encrypted Service Principal. GCP: encrypted Service Account JWT.
Ingest
Cost data pulled via official cloud APIs
AWS Cost Explorer, Azure Cost Management API, GCP BigQuery billing export — always read-only.
Process
Data normalized, analyzed, and stored encrypted
Cost metadata is encrypted at rest, encrypted in transit, and processed inside isolated application environments.
Act
Remediation requires human approval
Write operations gated by approval workflow. Protected tags exclude critical resources. Rate limited to 10 actions/min.
9 Security Control Layers
Every layer of the platform is designed with defense-in-depth principles.
Encryption at Every Layer
Provider-Specific Trust Models
AWS, Azure, and GCP are handled differently, but every path avoids plaintext exposure and keeps execution behind approval gates.
Dual-Layer RBAC
Page-level visibility and action-level permissions — independently configurable per role.
SOC 2 Readiness Framework
Coverage across all 9 Common Criteria (CC1–CC9) with built-in compliance controls.
Control Environment
RBAC, role definitions, organizational policies
Communication & Information
Audit trails, user notifications, system alerts
Risk Assessment
Risk scoring, anomaly detection, policy evaluation
Monitoring Activities
Real-time monitoring, health checks, uptime tracking
Control Activities
Approval gates, execution safety, rate limiting
Logical Access
JWT auth, OAuth, API token hashing, credential encryption
System Operations
Event bus, webhook delivery, outbox pattern
Change Management
PR analysis, policy enforcement, configuration auditing
Risk Mitigation
Protected tags, dry-run mode, dead-letter queues
How We Compare
The only option in this comparison that combines AI operations, commitment purchasing, policy enforcement, and governed remediation in one product.
| Capability | CloudHealth | Infracost | Kubecost | FinOps Co-Pilot |
|---|---|---|---|---|
| Multi-Cloud Spend | ✓ | — | — | ✓ |
| Pre-Merge PR Analysis | — | ✓ | — | ✓ |
| K8s Cost Attribution | — | — | ✓ | ✓ |
| AI Conversational Interface | — | — | — | ✓ |
| Automated Remediation | limited | — | — | ✓ |
| Commitment Purchasing | — | — | — | ✓ |
| Predictive Forecasting | basic | — | basic | ✓ |
| ChatOps Approvals | — | — | — | ✓ |
| Event Bus / Webhooks | limited | — | — | ✓ |
| Policy Engine | basic | basic | — | ✓ |
| Starting Price | $$$$ | Free (limited) | Free (limited) | $49/mo |
Security FAQs
Does FinOps Co-Pilot store our cloud credentials?
AWS uses IAM AssumeRole, so no static access keys are stored. Azure and GCP credentials are stored encrypted at rest using Fernet and are never exposed in logs, API responses, or the UI.
What data do you access?
Only cost and usage metadata. We read from Cost Explorer, Cost Management API, and BigQuery billing exports. We never access your application data, logs, or secrets.
Can auto-remediation break production?
We have multiple safety layers: protected-tag exclusion, human approval gates, rate limiting (10 actions/min), and dry-run mode. Critical resources tagged as protected are never touched.
Are you SOC 2 certified?
We built the platform for SOC 2 readiness from day one, with controls mapped to all 9 Common Criteria (CC1–CC9). Formal certification is in progress.
How do you handle data residency?
Cost data is processed and stored in the region you choose during onboarding. Enterprise plans support custom data residency requirements.
What happens if you have a breach?
Because AWS uses AssumeRole and Azure/GCP credentials are encrypted with strict exposure controls, the blast radius is limited to cost metadata and approved execution paths. Incident response, notification, and immutable audit trails support forensic review.
Secure. Compliant. Ready.
Start your free trial with enterprise-grade security from day one.