Security
How CostGuard approaches application and infrastructure security.
This page is a short orientation to the CostGuard security approach. It summarizes, in a shorter form, what the public Security overview and Data Access pages already describe. CostGuard is an early-stage product, and some of the controls described there are partially implemented or planned.
Identity and access
Sign-in uses Microsoft Entra ID. A connection to your Azure environment is created only after you configure it yourself, and CostGuard is designed to ask for the minimum practical read access to cost, billing, and subscription metadata. You keep control of the permissions you grant and can withdraw them from the Azure portal at any time.
Data protection
CostGuard stores normalized cost records, daily and service-level summaries, and the account information needed to run the service. Sensitive application configuration such as certificates and connection secrets is designed to live in Azure Key Vault rather than in application settings or source code, and the Azure credentials you grant are not stored by CostGuard.
Operational safeguards
Development uses code review, automated testing, and a deployment pipeline with review gates. Logging is designed to leave out secrets, tokens, raw provider payloads, and detailed customer cost data, and customer-facing errors are written as safe summaries. Each account works inside a single isolated workspace, and workspace scoping is applied through the application data layer.
Customer responsibilities
You decide which Azure subscriptions to connect and at which permission level. Workspace owners and administrators manage users, report recipients, and access inside their own workspace. Reviewing the Azure consent screen before granting access, and removing access you no longer need, stay with you.
What this page is not
This page is a public overview of a working design. It is not audit evidence, not certification evidence, and not a promise about any particular outcome. It does not claim an independent audit, a completed security assessment, or a security certification. The Security overview and Data Access pages remain the fuller descriptions.