/
Security
Security
and data access
Costory works from billing and usage exports. It does not run agents in your infrastructure, deploy code or read your application data.
Principles
Least access by design
01
Billing exports only
Costory ingests native billing exports, such as AWS CUR 2.0 or the Google Cloud billing export, set up with Terraform or CloudFormation.
02
No write access
Costory never gets write access to your cloud accounts. MCP actions only create Costory objects: alerts, reports, dashboards and events.
03
No agents, no code
Nothing runs inside your infrastructure, and no application data is accessed.
04
Read-only keys for AI and data platforms
Where a provider needs an API key, Costory uses read-only access, for example an OpenAI read-only Admin API key.
05
Scoped MCP access
The MCP server uses OAuth. Each answer is scoped to the user’s workspace role and team.
06
EU data residency
Costory is a French company based at Station F, Paris, and stores and processes data in the EU.
Data access
What Costory can and cannot see
Data
Access
Cloud billing and usage exports
Read
LLM and data platform usage and cost
Read, via read-only keys
Business metrics you choose to send
Read
Cloud resources and configuration
No write access
Application data and source code
No access
Identity and access
Access control that scales with the team
Every plan supports domain auto-join. Copilot Pro adds enterprise single sign-on. Role-based access and team scopes decide what each user, and each assistant acting for them, can see.
Admin
Workspace settings, integrations, all teams
Team member
Costs and alerts for their teams
Assistant via MCP
Same scope as the signed-in user
Simplified illustration. See the docs for the exact roles.
Security reviews
Running a security review?
Connect in under 30 minutes. Get your first optimization recommendation the next day.
30-day free trial. Plans from €250/month, billed annually.
First optimization recommendation
The next day
ROI
Pays for itself with the first recommendation you act on
Setup
About 30 minutes
Data residency
EU
Access
Read-only on your cloud