Skip to content
leancosts docs

Security and data handling

leancosts is built read-only. The posture below is enforced in code, not promised in a policy doc — it is the same architecture our own security review runs against. For the full legal documentation (DPA + security overview), email sales@leancosts.com.

Read-only by construction

Section titled “Read-only by construction”

leancosts connects to your cloud with read-only credentials and never writes to, mutates, or provisions anything in it. Every recommendation is a guided kit your own team runs — never a button that reaches into your account. Nothing executes without dual-control — two people, never one; no one approves their own change — even when the autonomous loop is running. This is a property of how the system is built, not a setting you have to trust us to keep.

Least privilege — what we ask for

Section titled “Least privilege — what we ask for”

We request the narrowest read-only access that surfaces the savings, and nothing that can change a resource. The exact grants, split into required and optional, are in Connect a cloud account.

  • Azure trial — one subscription, Reader + Cost Management Reader only: cost and inventory metadata, not log contents.
  • Azure full estate — adds read-only roles you scope yourself (Log Analytics Reader for ingestion-cost analysis; optional Reservations, Backup and Billing readers, each safe to skip).
  • AWS — a read-only cross-account role (the AWS-managed ReadOnlyAccess plus a small Cost Explorer / CUR read policy). Nothing that can mutate a resource.
  • GCP — viewer roles only (billing, asset, monitoring, and BigQuery read).

Encryption

Section titled “Encryption”

Cloud credentials are encrypted at rest with AES-256-GCM; every connection travels over TLS in transit. The encryption key is held outside the database.

Tenant isolation

Section titled “Tenant isolation”

Every organization’s data is isolated by Postgres row-level security. Each query is scoped to its organization at the database layer — not only by application filters — so one tenant’s data is unreachable from another’s session.

Where it runs

Section titled “Where it runs”

leancosts is hosted on Railway (the application and the Postgres database) with Cloudflare for CDN, static hosting, and off-site backups (R2). The hosting region and data-residency terms are set out in the DPA.

Access ends when the relationship does

Section titled “Access ends when the relationship does”

When a trial expires or a tenant is deleted, access is revoked and the associated data is removed. You hold the off switch throughout: disconnecting a cloud or deleting your workspace stops all access immediately.