Security

Last updated October 13, 2026

How we access your AWS account

CostPulse reads your AWS billing data through a cross-account IAM role that you create and control, using a CloudFormation template we provide. The role is read-only: it can read your Cost and Usage Report (CUR) files, Cost Explorer cost and usage data, and CloudWatch metrics, and it has no permission to write, delete, or modify anything in your account. The IAM permissions page lists every action it grants. CostPulse calls each one; nothing is granted just in case.

By default the same stack also creates an S3 bucket, its bucket policy, and a CUR 2.0 export so AWS delivers billing data for CostPulse to read. These live in your account and belong to you; the bucket is kept if you delete the stack.

You can revoke access at any time by deleting the IAM role (or the whole stack) from your AWS account. That takes effect immediately and permanently — we have no other path into your environment.

What we can't do

• No access to S3 object contents outside the CUR export, RDS databases, application logs, secrets, or parameters.
• No write, delete, or configuration-change permissions anywhere in your account.
• No AWS credentials of yours ever touch our servers — only the ARN of the read-only role you provision.

Encryption

Data in transit is encrypted with TLS 1.2+. Data at rest — spend baselines, alert history, account configuration — is encrypted with AES-256: AWS-managed KMS keys for DynamoDB, SSE-S3 for object storage.

Infrastructure

The service runs entirely on AWS. Application data is stored in DynamoDB and S3. Access to production systems is restricted by least-privilege IAM roles and requires multi-factor authentication. Account sign-in is handled by Amazon Cognito; we don't store your password. You can turn on two-factor authentication for your own CostPulse account from your account page.

Vulnerability disclosure

If you find a security issue, please report it to [email protected] rather than filing a public issue. Include a description of the issue, reproduction steps, and any relevant logs. We aim to acknowledge reports within 2 business days and provide a remediation timeline within 7 business days of acknowledgement.

Subprocessors

We use Amazon Web Services for infrastructure, Stripe for payment processing, and Cloudflare for DNS and content delivery of the website. Alert content is delivered to the Slack or Microsoft Teams workspace you connect, or by email via Amazon SES; we don't share account or billing data with those platforms beyond the alert message itself. Full detail in our Privacy Policy.

Compliance

CostPulse is early-stage and does not yet hold formal certifications such as SOC 2 or ISO 27001. If a security review is part of your evaluation, email [email protected] and we'll work through your questionnaire directly.

Contact

CostPulse LLC · [email protected] · costpulse.io