Platform · How it works
Four steps, and only the first one is yours.
Setup is a single read-only permission grant — a console permission, not a screen to work through. Everything after that is our problem.
Connect
One read-only IAM grant. No keys, no agents.
You enable Google Cloud’s FOCUS billing export — a Google-native feature, not something we install — and grant our service account read access to it. That grant is the entire integration, and you can revoke it from your own console at any time.
Ingest
Exactly once, including your provider’s corrections.
Google restates roughly the last five days of billing data, and emits corrections and credits as new rows rather than editing old ones. We track which export batches have been loaded and never load one twice, and re-scan a deliberately generous window so restated rows are caught rather than missed — which makes re-running ingestion after a failure safe by construction.
Normalize
To FOCUS — an open standard, not our dialect.
Cost rows are normalized to FOCUS, the FinOps Foundation’s open specification for cloud cost and usage data: the same field names and definitions your provider and your other FinOps tooling already use. The data model you learn here is not knowledge you throw away.
Analyze
Slice it by whatever your data actually carries.
Cost over time, broken down by service, project, region, SKU and more, with cascading filters that only ever offer you values that exist in your data. Period-over-period comparison reports its own coverage, so a partial month is labelled as one rather than quietly looking like a decline. Any view you land on can be saved as a named report and shared read-only inside your organization.
Access and data
The least access that does the job.
A cost tool should not be able to touch your infrastructure, and should not need anything installed inside it. Ours can't, and doesn't.
Read-only, and revocable by you
The only access we ask for is read permission on your billing export. The grant lives in your console — revoke it at any time and ingestion simply stops.
Nothing runs in your environment
No agent, no sidecar, no collector, no daemon. Access is granted between cloud identities directly, so there is no credential file to store, rotate, or leak.
Billing data, not workload data
We ingest cost and usage metadata — which services ran, in which projects and regions, at what SKUs and cost. Not your application data, databases, logs, or source code.
Tenant isolation on every query
Every query against cost data is scoped to the tenant making it, enforced in the data access layer and covered by automated tests.
Want to go deeper before connecting anything? Ask, and we'll walk your security team through the architecture directly — that conversation is with the person who built it.
Early access
See it against your own bill.
A short form, then a call. If it is a fit, we set up your account by hand and connect one Google Cloud billing export — read-only.