What a security review will ask, answered

A cost platform asks for access to every provider account a company has: the cloud, the AI providers, the data platforms. So before a buyer connects anything, their security team asks hard questions, and they should. This post answers the ones a security review asks first, with what CostReveal does today, and says plainly where something is not yet true.

How is one organization kept apart from another?

In the database itself. Every organization is separated by PostgreSQL row level security, forced on every table that holds customer data. The application connects as a role that is never a superuser, never bypasses row level security and never owns the tables; the service checks this each time it starts and refuses to run otherwise. Work across organizations, such as scheduled retention, runs in a separate system scope that each use must name, never under a customer's identity.

What access does CostReveal ask for?

Billing and usage data, through each provider's own mechanism, and the narrowest one it offers. For AWS that is a read only role with an external ID unique to your organization, which cannot create, change or delete anything. Each connector says exactly what it needs before it asks, and checks it before saving.

One honest exception: OpenAI and Anthropic offer cost reports only through an Admin API key, which neither lets you limit to reading. CostReveal says so before asking for one, only ever reads with it, and never shows it again once entered.

Provider credentials and identity provider certificates are encrypted with AES-256-GCM before they are stored, under keys that can be rotated without downtime.

How do people sign in?

• Two step verification with an authenticator app and single use backup codes. Owners and admins can require it of every member, on every plan. A member without it loses the organization on their next request until they turn it on, owners included.
• SAML single sign on on the Enterprise plan, limited to your verified company domain, with signed assertions required and single logout. It can be required of everyone on the domain but owners, so a problem with your identity provider never locks the organization out.
• Provisioning over SCIM 2.0 on the Enterprise plan: your identity provider adds people, updates them, deactivates them when they leave, and sets their roles from its groups. It is tested against the requests Okta and Microsoft Entra send; certification against live tenants is still to come, and we say so.
• Sessions: access tokens last ten minutes, refresh tokens rotate on every use, and a reused token ends the whole session as theft. Every person can see their sessions and end any of them. Passwords are hashed with Argon2id.

Who can see what?

Five roles, owner, admin, member, viewer and billing, each with a fixed set of permissions. Members and viewers see only the projects they are granted, and a role or access change applies on the very next request, not at the next sign in. The billing role lets finance run budgets, reports and chargeback without access to anything that changes how spend is read.

Is every change recorded?

Yes. Sign ins, invitations, role and access changes, and settings changes are recorded as they happen, with who made them and the address they came from. The audit log is append only: the application can add entries but cannot edit or delete them, and it cannot be turned off. Entries are kept for at least 90 days, and 365 days on the Enterprise plan.

Can CostReveal staff see our data?

Only through an inspection that states a reason. Inspections are read only for their whole duration and are recorded in a separate staff audit trail. Staff cannot open the system console, or inspect an organization, without two step verification.

How is the platform operated?

Every check of the figures runs each minute, and staff are alerted by email and Slack when one stops being healthy, again if it worsens, and when it recovers; each incident is kept. Every change is checked against published security advisories, and none is made while a high or critical one is open in what CostReveal depends on.

What about personal data?

Every person can export the personal data CostReveal holds about them, and erase their account; erasure anonymizes them in the audit trail and support tickets, so records stay intact without the person in them. The Data Processing Agreement is part of the terms on every plan.

What is not claimed

CostReveal does not hold SOC 2 or ISO 27001 certification today, and has not had a formal penetration test. A review that requires either should know that now, not after a questionnaire. The Enterprise plan includes security questionnaire support.

Keep reading

• CostReveal vs CloudZero: how two platforms compare, with sources.
• Connecting AWS to CostReveal: the read only role and its external ID.
• Chargeback finance can close: what the billing role is for.