Read-only billing access
Optimaze uses read-only service roles, API keys, and other read-only means to access billing and usage data across all integrations. We do not require credentials that grant write access to your cloud infrastructure or workloads. Integration credentials and API keys are stored encrypted in Optimaze. Should you have any other questions, contact us at support@optimazehq.com.Cross-account IAM roles on AWS
Optimaze uses a cross-account IAM role to sync billing data from your AWS Cost and Usage Report (CUR) in S3. This is the AWS-recommended approach. When you grant Optimaze access by deploying the provided CloudFormation stack, the stack creates a cross-account role with inline policies scoped to billing data access. These policies are a trimmed-down version of read-only access — they allow Optimaze to read CUR objects from your S3 bucket without access to application workloads, databases, or sensitive resources in your account. See AWS integration for setup steps and the data flow summary.Customising cross-account role permissions
Optimaze requests read-only permissions when creating the cross-account role on your behalf. If the default permission set is broader than you need, you can work with Optimaze support to provision a custom role with a narrower scope. Keep in mind that reducing the role’s permissions may limit certain functionality in Optimaze. Contact support@optimazehq.com before creating a custom role so we can provide the attributes required to prevent the confused deputy problem.Data revocation
You can revoke Optimaze access to your cloud billing data at any time:- Remove an integration — delete the AWS (or other provider) integration from Integrations in the dashboard. Optimaze stops syncing new data from that source.
- Revoke the IAM role — remove or disable the cross-account IAM role in your AWS account. Optimaze can no longer read billing data from your bucket.
- Delete your account — contact Optimaze support to request account deletion. All associated data is removed.
Data sharing
We do not share customer data externally. We do not sell or share any user data with any third parties.Frequently asked questions
Does Optimaze hold security certifications, such as SOC 1, SOC 2, or ISO 27001?
Does Optimaze hold security certifications, such as SOC 1, SOC 2, or ISO 27001?
Visit the Optimaze Trust Center to view current certifications and request copies of compliance reports.
How does Optimaze handle security reports from researchers?
How does Optimaze handle security reports from researchers?
We review every security report we receive. Contact security@optimazehq.com with details of any suspected vulnerability. We follow internal policies and standards to triage, investigate, and remediate reported issues.
Does Optimaze support 2FA, SSO, or other defensive options?
Does Optimaze support 2FA, SSO, or other defensive options?
Yes. Optimaze supports enterprise single sign-on (SSO) via SAML and OIDC, and multi-factor authentication (MFA) for dashboard login when enabled for your organisation.For programmatic access, use API keys with organisation-scoped permissions rather than user credentials.
How is customer data protected, and who has access to it?
How is customer data protected, and who has access to it?
All data is encrypted in transit and at rest. Only a limited subset of Optimaze employees with a business need can access customer data, and access is reviewed regularly.
Do you use third parties, and what can they access?
Do you use third parties, and what can they access?
Optimaze uses a subset of third parties for infrastructure, analytics, support, and payment processing. Cost and billing data is not shared with third parties for their own purposes. See the Optimaze Trust Center for subprocessor and vendor details.
Do you have a security contact in case of incidents?
Do you have a security contact in case of incidents?
Contact security@optimazehq.com for security-related enquiries. Upon request, a member of the security team can be assigned to your account for sensitive investigations.
Do you log access by Optimaze employees who can view customer data?
Do you log access by Optimaze employees who can view customer data?
Yes. Access to customer data by Optimaze staff is logged and audited.
Does Optimaze store cloud infrastructure metadata?
Does Optimaze store cloud infrastructure metadata?
Yes. Optimaze stores billing and usage metadata needed to attribute costs, build dashboards, and power workflows.
Does Optimaze use fixed IP addresses when connecting to external providers?
Does Optimaze use fixed IP addresses when connecting to external providers?
Optimaze infrastructure uses controlled egress for integrations where fixed IP allowlisting is required. Contact support@optimazehq.com if you need current IP ranges for your firewall or cloud provider allowlists.