Book a demoStart free

Security

Read-only access. Cost data only. Nothing more.

CloudQuell reads your AWS billing data through a read-only IAM role you control. We never touch your workloads, your customer data, or your production infrastructure.

  • Read-only by design

    A cross-account IAM role with least-privilege permissions scoped to Cost & Usage Reports and Cost Explorer. No write actions, no agents, no payload access.

  • You control the integration

    Revoke access any time by deleting the IAM role in your account. No support ticket required. We surface the exact policy you grant before you connect anything.

  • Encrypted end-to-end

    TLS 1.3 in transit. AES-256 at rest with AWS-managed keys. Logical isolation per organization with auditable access trails.

IAM model

What you grant CloudQuell

CloudQuell uses AWS cross-account role assumption with an ExternalId, following AWS guidance to mitigate the "confused deputy" problem. The role is attached to a single inline policy that lists the exact actions we need — nothing more.

Trust policy (your AWS account)

{
  "Version": "2012-10-17",
  "Statement": [{
    "Effect": "Allow",
    "Principal": { "AWS": "arn:aws:iam::CLOUDQUELL_ACCOUNT_ID:root" },
    "Action": "sts:AssumeRole",
    "Condition": {
      "StringEquals": {
        "sts:ExternalId": "YOUR_UNIQUE_EXTERNAL_ID"
      }
    }
  }]
}

Inline policy (attached to the role)

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "ReadCURBucket",
      "Effect": "Allow",
      "Action": [
        "s3:GetObject",
        "s3:ListBucket",
        "s3:GetBucketLocation"
      ],
      "Resource": [
        "arn:aws:s3:::YOUR-CUR-BUCKET",
        "arn:aws:s3:::YOUR-CUR-BUCKET/*"
      ]
    },
    {
      "Sid": "CostExplorerAccess",
      "Effect": "Allow",
      "Action": [
        "ce:GetCostAndUsage",
        "ce:GetCostForecast",
        "ce:GetAnomalies",
        "ce:GetReservationPurchaseRecommendation",
        "ce:GetSavingsPlansPurchaseRecommendation",
        "ce:GetRightsizingRecommendation"
      ],
      "Resource": "*"
    },
    {
      "Sid": "OrganizationsAccess",
      "Effect": "Allow",
      "Action": [
        "organizations:ListAccounts",
        "organizations:DescribeAccount"
      ],
      "Resource": "*"
    },
    {
      "Sid": "OptimizerAccess",
      "Effect": "Allow",
      "Action": [
        "compute-optimizer:GetEnrollmentStatus",
        "compute-optimizer:GetEC2InstanceRecommendations",
        "compute-optimizer:GetAutoScalingGroupRecommendations",
        "compute-optimizer:GetEBSVolumeRecommendations",
        "compute-optimizer:GetLambdaFunctionRecommendations",
        "compute-optimizer:GetRDSDatabaseRecommendations",
        "compute-optimizer:GetECSServiceRecommendations",
        "cost-optimization-hub:ListEnrollmentStatuses",
        "cost-optimization-hub:ListRecommendations",
        "cost-optimization-hub:GetRecommendation"
      ],
      "Resource": "*"
    }
  ]
}
  • Exact actions may vary by account; final policy is documented as part of your onboarding.
  • No agents are deployed to your VPCs, EC2 instances, or workloads.
  • Role assumptions are logged in your AWS CloudTrail — you have a full audit trail.
  • Disable the role at any time in your AWS account to terminate the integration.

Boundary

What CloudQuell does not do

  • Access your application payloads, customer data, or production traffic.
  • Deploy agents or run code in your AWS account.
  • Make any write or modify-state API calls in your AWS account.
  • Sell or share your data with third parties for advertising or any other purpose.
  • Use your billing data to train shared models or improve other customers' experiences without your direction.

Compliance

Where we are on certifications

StandardStatus
SOC 2 Type IIn progress — targeting Q4 2026.
SOC 2 Type IIFollows Type I — observation window starts in 2027.
GDPRData processing aligned with GDPR principles. Our DPA (with SCCs and the UK Addendum) is published at /dpa and incorporated into the Terms — it applies automatically; countersigned copies available on request.
SSO / SAMLOn the roadmap for late 2026 alongside SOC 2.

Detailed security documentation and audit reports are available under NDA. The DPA is public at /dpa. Contact sales for the trust packet.