> ## Documentation Index
> Fetch the complete documentation index at: https://docs.costgraph.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Security and data handling

> How CostGraph signs people in, isolates tenants, stores credentials, and what it collects

This page is for security and procurement reviewers. It describes how CostGraph
Cloud authenticates people and machines, keeps organizations apart, handles the
credentials you give it, and what data it collects. For an install that keeps
your data in your own network, see [Self-hosted](#self-hosted).

## Infrastructure

CostGraph Cloud runs on AWS, and your data is hosted in the `us-east-2`
region. The app and API are served over HTTPS. Database storage is encrypted at
rest with AWS KMS.

## Sign-in

People sign in with one of:

* **Email and password.** Passwords need at least 8 characters, with upper and
  lower case letters, a number, and a symbol. People can add an authenticator
  app as a second factor under their account's **Security** settings.
* **Google.**
* **Your identity provider** through SAML or OpenID Connect
  [single sign-on](/costgraph/security/sso). Owners can require single sign-on
  for everyone with an email address at a verified domain.

[SCIM provisioning](/costgraph/security/scim) lets your identity provider create
and deactivate members, and map groups to roles.

## Access control

Every member has a role: owner, admin, billing admin, or member. See
[Roles and permissions](/costgraph/security/roles) for what each one can do.

An organization holds one or more tenants. Every request that reads or changes
tenant data names the tenant, and CostGraph checks that the caller can access
it before it runs. An API key or app token is bound to one tenant and can't
reach another.

## Machine credentials

* **API keys** carry scopes and act with their creator's current role.
  CostGraph stores a keyed hash of each key, never the key itself, and shows
  only its last four characters. A key can have an expiry date.
* **Apps** that use [Sign in with CostGraph](/costgraph/developers/sign-in-with-costgraph)
  get tokens limited to the scopes the person approved. App tokens can't
  manage API keys, single sign-on, or alert destinations.
* **SCIM tokens** are stored as hashes and shown once.

## Integration credentials

When you connect a provider, CostGraph prefers access that doesn't need a
long-lived secret:

* **AWS**: an IAM role that CostGraph assumes with an external ID. Access keys
  are also accepted.
* **Google Cloud**: workload identity federation. A service account key is
  also accepted.

Secrets you enter, such as API tokens and keys, are encrypted with AES-256-GCM
before they're stored, and each one is bound to its own connection. The API
never returns a stored secret.

## What CostGraph collects

CostGraph collects cost and usage data, not your application data.

| Source | Collects |
| - | - |
| [Provider integrations](/costgraph/integrations/overview) | Billing and usage data, through the provider's billing APIs |
| [Network access](/costgraph/integrations/aws#network-access) for AWS, Google Cloud, and Azure | Read-only inventory of networks, VMs, clusters, disks, and load balancers. It doesn't read data, logs, or secrets |
| [CostGraph Operator](/costgraph/operator/overview) | Kubernetes resources and usage metrics, with read-only access |
| [CostGraph Agent](/costgraph/agent) | Resource and network usage on your VMs |

The operator's cluster role lists the Kubernetes resources it can read.
Secrets, ConfigMaps, and service accounts aren't on that list, so the operator
can't read them.

## Support access

CostGraph support can view your organization only with your consent. An owner
or admin grants support access for a set period, from 1 to 168 hours, and can
revoke it at any time.

While access is granted, support sessions are read-only: any request that would
change something is refused. Each session lasts at most 30 minutes, every
request is recorded in your audit log, marked **CostGraph support**, and the
organization owner is notified.

## Data deletion

Organization data is deleted on request. The request must come from the
organization owner's registered email address, and the deletion is completed
within 30 days of the request.

Deleting an organization in the app closes it: the organization is deactivated
and no one can sign in to it. Its data is deleted when the owner requests
deletion.

Deleting a [Graph AI](/costgraph/graph-ai) chat deletes it permanently.

Database backups are kept for 7 days.

## Audit log

The [audit log](/costgraph/security/audit-log) records sign-ins, role and API
key changes, support access, and every change and export. Entries are kept for
one year. Owners and admins can read it in the app, export it as CSV, or read it
through the API.

## Self-hosted

[Self-hosted CostGraph](/costgraph/self-hosted/overview) runs in your own
infrastructure, on a database, cache, and metrics store you operate. Your cost
data, resource inventory, and metrics stay in your network. What leaves is your
licence status, aggregate billing quantities, and requests for public cloud
prices. Support access isn't available on self-hosted installs.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.