Skip to main content

​
Read-only by design

CostOptix only reads. It never creates, changes or deletes anything in your accounts, clusters or machines, and never buys anything for you, including commitments it recommends. For cloud accounts this is enforced by the permissions you grant, not only by our code. If CostOptix ever tried to write, your provider would refuse.

​
Credentials

  • Cloud credentials are encrypted at rest with AES-256-GCM and sent over TLS.
  • Agents and AI tools do not use stored credentials. They push data with a key that can only send that one kind of data. See API keys.
  • CostOptix warns you by webhook before cloud credentials expire, and when they have expired.
  • Deleting an account in Organization Admin → Accounts removes its stored credentials and cost data. Your cloud account is not touched.

​
Agents

All agents connect out to CostOptix over TLS. Nothing needs to reach into your network, and no inbound firewall rule is needed.

​
Kubernetes agent

  • Runs as a non-root user from a minimal image with no shell or package manager.
  • Reads metrics and workload metadata only. It never scales, resizes, evicts or changes anything.
  • Optional connection mapping adds one pod per node that reads the node’s connection table. These pods run as root on the node’s network, so they are off unless you turn them on. They record which workloads were connected, never what the connections carry.
See Kubernetes.

​
Host agent

  • Runs as root so it can read CPU and memory accounting for every unit on the machine.
  • Sends usage counters, unit names and which units connect to which. It never sends command lines or the contents of connections.
  • Runs under systemd with NoNewPrivileges, a read-only system and home directory, and a private /tmp.
  • The installer verifies the binary’s SHA-256 checksum and refuses to install one that does not match.
  • Set COST_OPTIX_CONNECTIONS=off to turn off connection mapping.
See Linux hosts.

​
AI coding tools

  • Prompts, responses and email addresses are never stored.
  • People are identified by a pseudonymous key. Admins can give a key a display name inside CostOptix.
  • Per-person figures are visible to admins only.
See AI coding tools.

​
Signing in

  • SSO with OpenID Connect is available on Business and Enterprise. It must pass a connection test before it can be turned on, so a bad setting cannot lock you out. See SSO.
  • Roles. Admin actions such as adding sources, managing users and changing budgets need the admin role. Members see sources in read-only mode. See Users and roles.

​
Webhooks

If you set a webhook secret, every delivery carries an X-Webhook-Signature header signed with HMAC-SHA256. Check it at your endpoint to confirm the delivery came from CostOptix. See Webhooks.

​
AI assistant

Your data is used only to answer your own questions and is not used to train models. Saved conversations are visible only to their author and are deleted 90 days after the last message. See AI Assistant.

​
Isolation

Each organisation’s data and credentials are stored separately. Enterprise deployments run entirely in your environment, so cost data never leaves it.

​
Your data

Your plan sets how far back you can query, not how long data is kept. Requests older than your plan’s window are limited to it rather than rejected. See Subscription Tiers. Cost data in your window can be exported to CSV at any time. There is no exit fee and no lock-in.

​
Reporting a vulnerability

Email security@costoptix.com with details and steps to reproduce. We will confirm receipt and keep you updated. Please do not disclose it publicly until we have had a chance to respond.