Security & Data Protection

This page summarizes how CostLens protects your data — useful background for your own security review, and a reference if you need to answer "how does CostLens handle X" internally.

What CostLens accesses — and what it doesn't#

CostLens connects to your AWS, Azure, and/or GCP accounts to read cost and usage data, analyze it for savings opportunities, and — only where you've explicitly authorized it — apply an approved fix.

CostLens reads and stores:

• Billing and usage data (service, region, cost, tags) via each cloud's native cost API.
• Resource metadata relevant to cost (instance types, sizes, configuration, tags).
• The recommendations and fix history CostLens itself generates.

CostLens does not access:

• Your application databases, object storage contents, or end-user data.
• Any credential beyond what's required to read cost/usage data (and, only if you separately authorize it, to apply a specific class of fix).

Cloud account access model#

CostLens never asks for your root or long-lived administrator credentials. Access is scoped per cloud, and you choose how much of it to grant.

Cloud	How access is granted	Anti-hijack protection
AWS	A cross-account IAM role (sts:AssumeRole) you create via a CloudFormation template you review before launching — see AWS Accounts	A unique, per-account ExternalId is required in the trust policy — AWS's own recommended defense against a third party being tricked into assuming the wrong role
Azure	An App Registration or OAuth sign-in granted Cost Management Reader (plus Reader/contributor-scoped access only if you opt into automated fixes) — see Azure Accounts	Least-privilege role assignment, scoped by you at the subscription or management-group level
GCP	A dedicated service account with BigQuery Data Viewer on your billing-export dataset; a keyless mode is available if your org policy blocks long-lived key creation — see GCP Accounts	Single-purpose service account, scoped to one project's billing export

You choose the access level. Every cloud offers a Read-Only grant (cost visibility and recommendations only) and a separate, opt-in Read/Write grant (adds the ability for CostLens to apply an approved fix directly). Nothing defaults to Read/Write. You can downgrade or fully revoke access at any time — deleting the IAM role (or equivalent) on your side immediately and completely cuts CostLens off, with no action needed from us.

If your resources are managed by Terraform, CostLens doesn't touch the live cloud resource for a fix at all — it opens a pull request against your own repository instead, and your team reviews and merges it through your own pipeline. See Infrastructure-as-Code Fixes.

Data protection & encryption#

Layer	How it's protected
Data in transit	TLS on every connection — your browser to CostLens, and CostLens to each cloud provider's API
Secrets at rest	Access keys, client secrets, webhook secrets, and integration tokens are encrypted before being written to the database — never stored in plaintext
Database at rest	Managed PostgreSQL with provider-level encryption at rest
Password storage	Sign-in is handled by Aezona Auth, CostLens's centralized identity service (see below) — CostLens does not independently store or verify passwords
Secret exposure via the API	Encrypted fields are never returned by any CostLens API response

Identity, authentication & access control#

Sign-in, MFA, and session/device management are handled by Aezona Auth, a dedicated identity service shared across every Aezona product — not reimplemented separately inside CostLens. See Multi-Factor Authentication for how to enroll.

• Single sign-on for every session.
• Two-factor authentication, enrolled and verified once at the identity layer.
• Trusted-device and session management, including revoking a specific device or signing out of every Aezona product and device at once.
• CostLens's own tokens are signed and short-lived, with server-side revocation — a revoked token stops working on its next request, not at its next scheduled expiry.
• Repeated failed sign-in attempts trigger a rate-limited lockout, and an organization admin can suspend all logins for the org instantly if needed.

Role-based access control then governs what a signed-in user can do inside CostLens — see Roles & Permissions for the full Admin / Operator / FinOps / Viewer breakdown. Every authorization denial is itself logged (see below).

Multi-tenant data isolation#

CostLens is a shared, multi-tenant application — every organization's data is logically partitioned, never physically separated. Every account, billing record, recommendation, and audit entry is tagged with an organization id, and every query is scoped to the requesting user's own organization at the database level.

Cross-tenant data exposure is treated as the highest-severity class of defect: role-based access and tenant-isolation behavior are covered by an automated regression test suite that runs on every change to the authorization layer.

Audit logging#

CostLens keeps three separate audit trails, each built for a different audience:

Trail	Covers	Who sees it
Organization audit log	Account connections, fixes applied, team and role changes, budgets and spend-alert rules, cloud-hierarchy syncs, and other org settings	You — self-service, exportable from the Audit Log page in your organization settings
Security event log	Sign-ins, failures, lockouts, token revocations, authorization denials	CostLens security/support staff
Internal staff audit log	Every action CostLens support/operations staff take on your organization	CostLens security/compliance staff — accountability for our own access to your data

Vulnerability management#

Dependency vulnerability scanning runs as a routine part of shipping CostLens, on both the frontend and backend, not as a one-off exercise. When a scan surfaces a fixable vulnerability, the dependency is upgraded, the fix is verified with a clean re-scan plus the full test/build pipeline, and it ships — typically within the same release cycle rather than waiting for a scheduled patch window.

Where an advisory has no available upstream fix, we evaluate whether the vulnerable code path is actually reachable in CostLens before deciding how to respond, rather than treating every advisory as equally urgent regardless of exploitability.

Compliance status#

CostLens has not yet completed a SOC 2 Type II or ISO 27001 audit. If a formal certification, an audit report, or a completed vendor-security questionnaire is a requirement for your organization, contact your CostLens account team — we can discuss our compliance roadmap and what's available today (including a detailed security overview and Data Processing Agreement).

Sub-processors#

CostLens uses a small number of third parties to deliver the service:

Category	Purpose
Application hosting	Runs the backend API, background workers, and database
Frontend hosting / CDN	Serves the web application
Managed database & cache	Stores application and billing-metadata records
AI narrative generation (Aevi)	Generates plain-English cost explanations from your account's own data, under a data-processing agreement that prohibits using customer data to train any model
Payments	Processes subscription billing — your payment details never touch CostLens's own servers
Transactional email	Delivers account, alert, and notification emails

A full, named sub-processor list is available as part of your Data Processing Agreement — contact your CostLens account team to request it.

Questions#

For anything not covered here — a specific questionnaire, a DPA request, or reporting a suspected security issue — open a support case or contact your CostLens account team.