Security
Runcost reads your cloud bills and produces statements finance will sign. That only works if the bill is read safely and the statement can be seen by exactly the people it concerns. This page describes how the platform is built to do that.
Read-only ingestion, no agents
Runcost ingests billing exports: AWS Cost and Usage Reports, Azure cost exports, Google Cloud billing exports, and FOCUS-format files. Access is read-only and scoped to billing data. Nothing is installed in your estate and nothing can change a resource.
Tenant isolation on every query
Each customer has its own analytical database. Every query the platform runs is scoped to your tenant by construction, through a signed, short-lived token that names the tenant it acts for, rather than by a filter a developer has to remember to add. Generated queries, including those behind AI-assisted reports, are validated against an allowlist of tables and cannot alter schema.
Identity
Sign-in is through your identity provider. Microsoft Entra ID single sign-on and SCIM provisioning are supported, so joiners, movers and leavers are handled where you already handle them. Roles are enforced on the server for every mutating action.
Audit trail
Administrative actions such as inviting a member, changing a role or signing in are written to an immutable audit log that survives the deletion of the actor. Application code cannot update or delete an audit row.
Hosting and encryption
The platform runs on Microsoft Azure. Data is encrypted in transit with TLS and at rest by the platform. Secrets are held in Azure Key Vault and are never defaulted in code: a missing secret stops the service rather than running with a published value.
Application controls
- Rate limiting on every request, per tenant and per address, before a handler runs.
- Cross-site request forgery protection enforced at the edge for every state-changing request.
- Input parsed and validated once at the boundary; anything unexpected is refused rather than cleaned up.
- Structured logs that carry a correlation id and never a customer email or secret.
Reporting a vulnerability
If you believe you have found a security issue, email [email protected] with the details. We acknowledge reports within two working days and will not take action against good-faith research.