Read-Only. Zero Trust.
You're handing over the keys to your house, so we made sure they only open the front door. We use strict role assumption, read-only policies, and encrypt everything.
Ironclad Encryption
Everything is encrypted at the application layer with AES-256 before it ever hits a database. Data in transit is TLS 1.3.
We Never Mutate State
GhostCost is strictly an observer. We only request an IAM Role with basic billing and metadata read permissions. Nothing more.
Immutable Logs
We log every internal move we make. You can audit us anytime.
The IAM Policy
We're developers too. Here is the exact IAM policy we request. No hidden privileges.
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"s3:GetObject",
"s3:GetBucketLocation",
"s3:ListBucket"
],
"Resource": [
"arn:aws:s3:::your-cur-bucket",
"arn:aws:s3:::your-cur-bucket/*"
]
}
]
}Full Developer Transparency
Every read. Every scan. Logged and visible. We never have write access.
Every API call uses strict read-only IAM permissions
STS AssumeRole with ExternalId — scoped & temporary
Full CloudTrail visibility right in your own AWS account
No plaintext credentials ever stored. Zero trust.
Doing things right
We hate cutting corners when it comes to security.
SOC2 Type II
In Progress
GDPR
Compliant
Data Residency
EU & US
99.9% Uptime
SLA