Security at CostGuard
Security is a core part of how CostGuard is designed. This page explains our approach to Azure access, data handling, secrets management, and operational security in plain language. We aim to be honest about where we are today and where we are headed.
1. Azure access and permissions
CostGuard connects to your Azure environment only after you explicitly configure an Azure connection through the CostGuard settings. We use Microsoft Entra ID (Azure Active Directory) to authenticate and to obtain the permissions you grant. CostGuard is designed to read only the cost, billing, and subscription metadata needed to power dashboards, reports, recommendations, and forecasts. We do not request broad write access to your Azure resources for the current product.
2. Least-privilege access
Our approach to Azure permissions is to ask for the minimum practical level of access needed to provide the service. We prefer read-only roles where the required data is accessible through them. You remain in control of the permissions you grant and can revoke CostGuard's access at any time directly from the Azure portal. We do not store your Azure credentials or secrets.
3. Cost data we process
CostGuard stores normalized cost records, daily and service-level summaries, and the account information needed to operate the service. This data is used to generate the dashboards, cost breakdowns, recommendations, forecasts, and reports that make up the CostGuard product. We do not store raw Azure provider responses or internal Azure metadata beyond what is required for these purposes.
4. Key Vault and sensitive configuration
Sensitive application configuration — including certificates and connection secrets — is designed to be stored in Azure Key Vault rather than in application settings or source code. Our application retrieves these values at runtime through managed identity where possible. We do not commit secrets, connection strings, or certificate data to source control.
5. Safe logging and error handling
Our logging approach is designed to avoid capturing secrets, raw provider payloads, tokens, or detailed customer cost data in application logs. Customer-facing error messages are intended to be safe summaries that do not expose internal infrastructure details, stack traces, or raw Azure error responses. We review log output as part of our development and review process.
6. Workspace isolation
CostGuard is designed so that each account operates within a single isolated workspace. Cost data, Azure connections, recommendations, and reports are scoped to the correct workspace and are not accessible to other accounts. We apply workspace scoping throughout the application data layer and review it as part of our development process.
7. Operational security
We apply code review, automated testing, and least-privilege deployment practices as part of our development workflow. Application deployments follow a CI/CD pipeline with review gates. We aim to keep dependencies up to date and to address vulnerabilities promptly. We monitor the application and infrastructure at a basic operational level and plan to expand monitoring as the product matures.
8. Your controls
You control which Azure subscriptions you connect to CostGuard and the permission level you grant. You can disconnect a subscription at any time, deactivate a workspace member's access, and change who receives scheduled reports. CostGuard has no self-service account deletion today; to request removal of your data, use the Contact page. Privacy Policy
9. Contact us
Hoshebartar Technologies
If you have questions about our security approach, want to report a vulnerability, or have concerns about how your data is handled, please contact us through our Contact page. We take security feedback seriously and will respond as promptly as possible.