Your cost data, handled with care
Finsimul is built around a simple principle: we ask for the least access we need, we never change anything in your accounts, and we keep your data isolated and encrypted.
Read-only access
Finsimul connects to your cloud billing exports using least-privilege, read-only access. For AWS this is a cross-account IAM role you create and control, scoped to billing and usage data — we cannot create, modify or delete resources in your accounts.
Encryption in transit & at rest
All connections to Finsimul use TLS. Data is encrypted at rest in our hosting environment. The customer portal is served over HTTPS only, with HSTS enforced.
Strict tenant isolation
Every customer's data is logically isolated. Access is enforced at the database layer with row-level security so that one customer can never see another's data — isolation does not depend on application code alone.
Secrets, not keys in files
Credentials and connection secrets are held in a managed secrets store and referenced at runtime — never hard-coded and never committed to source control.
Authentication
Portal sign-in uses Google OAuth via the secure server-side authorization-code flow. Access is limited to users your organisation has authorised, and sessions use secure, HTTP-only cookies.
Audit logging
Changes to managed data are recorded in an append-only audit log capturing who did what and when, supporting accountability and investigation.
One role, one direction
The read-only claim above, drawn rather than asserted. Finsimul reads your billing export through a role you create and control — there is no path back into your account.
- Your AWS, Azure, or GCP account exports billing data (CUR v2, Cost Export, or Billing Export) to a bucket you own.
- Finsimul reads that bucket through a role you create and scope: an AWS cross-account IAM role verified via
sts:AssumeRolewith an external ID, an Azure App Registration granted Cost Management Reader, or a GCP service account granted BigQuery Data Viewer. - That role is read-only. Finsimul ingests, normalises, summarises, and reports on the data.
- There is no path back into your account — no write, no delete, no API calls beyond the one read.
Hosting
Finsimul runs on Amazon Web Services in the Asia Pacific (Sydney) region (ap-southeast-2). Network access to data stores is restricted, and infrastructure is defined as code.
Data retention
We retain customer cost data and personal data only as long as needed to provide the service and meet legal obligations. Default retention periods are set out in our Privacy Policy and Data Processing Addendum. Enterprise customers can agree custom retention terms.
AI processing
Cost data slices and your supplied context are sent to our AI provider to generate report analysis and recommendations. This sub-processor is disclosed in our Sub-processor list, and the data shared is limited to what the analysis requires.
Compliance roadmap
We follow recognised FinOps and security best practice today and are building toward formal third-party attestations (SOC 2 Type II, ISO 27001) as the company scales.
Reporting a vulnerability
We welcome responsible disclosure and will not pursue legal action against good-faith security research that stays within the scope below. Report a suspected issue to security@finsimul.com — describe the issue, the steps to reproduce it, and its potential impact. We aim to acknowledge a report within 3 business days and will keep you updated as we investigate and remediate. Our machine-readable policy is published at /.well-known/security.txt.
In scope: finsimul.com and its subdomains (the marketing site, customer portal, and admin console).
Out of scope: any account, tenant, or data that is not your own; denial-of-service or volumetric testing; social engineering or phishing directed at Finsimul staff or customers; automated scanning aggressive enough to degrade the service for other users; and any third-party service we integrate with but do not operate (see our sub-processor list).
Test only against your own account, avoid accessing or modifying another tenant's data, stop and report immediately if you do encounter another tenant's data, and give us a reasonable window to remediate before any public disclosure. Reports that follow these guidelines will not result in legal action from Finsimul.