Loading
Security and trust
For each platform: the credential, what we call with it, and what it could technically do. A marked cell is a place where the key can do more than we use it for. We say so rather than hide it.
Drawn from each platform's own documentation. [Date last checked to be confirmed.] Platforms change their keys, so we review this table every month.
Your key is stored in a secrets vault. Our application tables hold only a reference to it, never the value.
We validate a key on the server when you connect. A key that fails is never stored.
A key is decrypted only inside the background workers that run your scan. It never reaches your browser.
Errors pass through a redactor and our logs drop any field that looks like a credential.
Disconnect and we destroy our copy at once and cancel any scan in progress. The key stays live at the platform until you delete it there, so delete it too.
Connecting, disconnecting, scans, fixes marked as done and membership changes go into an audit log that cannot be edited after the fact.
We handle: We handle your account details, billing and usage metadata (information about usage, not your application's content), and any contract you choose to upload.
We never see: We never see prompts, replies, database rows, files or your customers' details.
Retention: We keep metadata for [number] months to show trends. Disconnect a platform and we delete its data within [number] days. Delete your organisation and we remove its data and its uploaded files. Keys are destroyed at once.
Region: [hosting region].
Encryption: Data is encrypted in transit, and at rest by our database host. Keys are held in a vault and we never log their values.
Access: Every table is protected by row-level security, so one organisation cannot read another's data. [Who at Critical Cloud can reach production data, and how that access is controlled and recorded, to be described once confirmed.]
We use a language model for one job: reading rates from a contract you upload. It is optional, and you confirm every value before we use it in a calculation. Our findings and savings are worked out by fixed rules, not by a model.
What is sent, where it goes and how long it is kept is set by the model provider listed below. [Whether that provider uses contract text for training, and how long it keeps it, to be confirmed with the provider before launch.]
| Company | Purpose | Data | Location | Added |
|---|---|---|---|---|
| Supabase | Database, sign-in and background jobs | Account details, usage and billing metadata, uploaded contracts, and stored keys in its vault | [region] | [date] |
| Vercel | Website and app hosting, and anonymous page-view statistics for the public pages | Request logs, and page-view counts with no cookie, not used to identify you or follow you across sites (the address is counted without its query string) | [region] | [date] |
| Stripe | Payments for the paid plan | Billing details | [region] | [date] |
| Resend | Report and service emails | Email address and the content of the email | [region] | [date] |
| Anthropic | Reading rates from a contract you upload | Contract text, only if you upload one | [region] | [date] |
| [Operational logging service] | Service logs, so we can see that the product is working | Event names and identifiers, never credential values | [region] | [date] |
We give [number] days' notice before adding a sub-processor. Last updated [date].
CostAssured is a product of Critical Cloud Limited, registered in England and Wales and based in Cardiff.
Email security@costassured.ai. We reply within [number] working days. We do not run a bounty.
[Our promise not to take action against good-faith research, in words our solicitor has approved.]
Got a question before you connect? Ask a security question and an engineer will answer. Our security.txt lists the same contact.
Connect in a few minutes. Your first report arrives within about 24 hours.