We ask for the minimum permissions needed. Here's exactly what we read, what we write, and what we never touch.
CostSage connects to AWS using an IAM role with read-only permissions for analysis, and scoped write permissions for approved execution actions only.
Every action logged: All execution actions are logged to CloudTrail for complete auditability. You maintain full visibility and control.
CostSage integrates with Azure using RBAC (Role-Based Access Control) with Reader role for analysis and scoped Contributor permissions for approved actions.
Granular control: You choose which resource groups CostSage can modify. No access to other subscriptions unless explicitly granted.
These are strictly off-limits, regardless of permissions granted.
Source code — No access to CodeCommit, GitHub, or container registries
Application secrets — AWS Secrets Manager, Key Vault stay private
Database contents — We read size/performance metrics only, never data
Customer PII — No access to user data, customer records, or sensitive logs
S3 object contents — Bucket metadata only; object data is never read
Private networking configs — VPC internals, security groups, NACLs stay hidden
How we protect your data and how long we keep it.
Here's exactly what happens when you connect CostSage to your cloud account.
Connect
Enter AWS or Azure credentials via OAuth/SAML
Grant Read-Only
IAM role or RBAC Reader role
Review Analysis
See savings opportunities
Approve & Execute
Scoped write role for actions
During setup, you'll see every permission CostSage asks for and can review it before granting access.
Free 14-day trial · No credit card · 60-sec setup