Your cost data, handled with care

Finsimul is built around a simple principle: we ask for the least access we need, we never change anything in your accounts, and we keep your data isolated and encrypted.

Read-only access

Finsimul connects to your cloud billing exports using least-privilege, read-only access. For AWS this is a cross-account IAM role you create and control, scoped to billing and usage data — we cannot create, modify or delete resources in your accounts.

Encryption in transit & at rest

All connections to Finsimul use TLS. Data is encrypted at rest in our hosting environment. The customer portal is served over HTTPS only, with HSTS enforced.

Strict tenant isolation

Every customer's data is logically isolated. Access is enforced at the database layer with row-level security so that one customer can never see another's data — isolation does not depend on application code alone.

Secrets, not keys in files

Credentials and connection secrets are held in a managed secrets store and referenced at runtime — never hard-coded and never committed to source control.

Authentication

Portal sign-in uses Google OAuth via the secure server-side authorization-code flow. Access is limited to users your organisation has authorised, and sessions use secure, HTTP-only cookies.

Audit logging

Changes to managed data are recorded in an append-only audit log capturing who did what and when, supporting accountability and investigation.

One role, one direction

The read-only claim above, drawn rather than asserted. Finsimul reads your billing export through a role you create and control — there is no path back into your account.

Finsimul's read-only access model Your cloud account exports billing data to a bucket you own. Finsimul reads that bucket through a read-only role you create — AWS cross-account IAM role with an external ID, Azure App Registration with Cost Management Reader, or GCP service account with BigQuery Data Viewer. Finsimul ingests, normalises, summarises and reports on that data. There is no path back into your account: no write, no delete, no API calls beyond the one read. Your cloud account AWS · AZURE · GCP Billing export bucket CUR v2 · Cost Export · Billing Export Finsimul AP-SOUTHEAST-2 Ingest → Normalise → Summarise → Report read-only role e.g. AWS AssumeRole + ExternalId NO WRITE PATH — EVER
  • Your AWS, Azure, or GCP account exports billing data (CUR v2, Cost Export, or Billing Export) to a bucket you own.
  • Finsimul reads that bucket through a role you create and scope: an AWS cross-account IAM role verified via sts:AssumeRole with an external ID, an Azure App Registration granted Cost Management Reader, or a GCP service account granted BigQuery Data Viewer.
  • That role is read-only. Finsimul ingests, normalises, summarises, and reports on the data.
  • There is no path back into your account — no write, no delete, no API calls beyond the one read.

Questions from your security team?

We're happy to walk through our controls and data handling. Reach out and we'll help your review.

Contact Us