Snapshot 132049
Normalized text
Scripts and page chrome removed; this is what change detection compares.
Home / Security Security Security Security and data access Costory works from billing and usage exports. It does not run agents in your infrastructure, deploy code or read your application data. Talk to us Access control docs Principles Least access by design 01 Billing exports only Costory ingests native billing exports, such as AWS CUR 2.0 or the Google Cloud billing export, set up with Terraform or CloudFormation. 02 No write access Costory never gets write access to your cloud accounts. MCP actions only create Costory objects: alerts, reports, dashboards and events. 03 No agents, no code Nothing runs inside your infrastructure, and no application data is accessed. 04 Read-only keys for AI and data platforms Where a provider needs an API key, Costory uses read-only access, for example an OpenAI read-only Admin API key. 05 Scoped MCP access The MCP server uses OAuth. Each answer is scoped to the user’s workspace role and team. 06 EU data residency Costory is a French company based at Station F, Paris, and stores and processes data in the EU. Data access What Costory can and cannot see Data Access Cloud billing and usage exports Read LLM and data platform usage and cost Read, via read-only keys Business metrics you choose to send Read Cloud resources and configuration No write access Application data and source code No access Identity and access Access control that scales with the team Every plan supports domain auto-join. Team adds enterprise single sign-on. Role-based access and team scopes decide what each user, and each assistant acting for them, can see. Identity and access docs → Admin Workspace settings, integrations, all teams Team member Costs and alerts for their teams Assistant via MCP Same scope as the signed-in user Simplified illustration. See the docs for the exact roles. Security reviews Running a security review? Send us your security questionnaire or procurement requirements and we’ll get back to you. Our Master Subscription Agreement includes a Data Processing Addendum (DPA). Send us your security questionnaire or procurement requirements and we’ll get back to you. Our Master Subscription Agreement includes a Data Processing Addendum (DPA). Contact us Read the MSA and DPA Connect in under 30 minutes. Get your first optimization recommendation the next day. 30-day free trial. Plans from €250/month, billed annually. Start free trial Book a demo First optimization recommendation The next day ROI Pays for itself with the first recommendation you act on Setup About 30 minutes Data residency EU Access Read-only on your cloud