Find AWS & Azure waste in under a minute.
Drop 3–12 monthly billing exports. Get a board-ready report with Reserved Instance / Savings Plan recommendations, Terraform + CLI remediation, and AI narration — every number cited to a specific line item.
Cited findings, not vibes
Every dollar claim traces to specific bill line items. The deterministic engine emits the numbers; the LLM only writes prose around them and is rejected if it can't cite.
Remediation, not just diagnosis
Each finding ships with a Terraform stanza and AWS CLI command you can paste. Investigation steps come before destructive fixes — never the other way around.
Agentless, self-hosted
No cross-account IAM. No installed collectors. Caddy ingress, API-key gated engine, SQLite persistence. Lives on a $5 VPS or your existing platform.
AWS & Azure on day one
Auto-detects CUR vs Azure Cost Management export. Same pipeline, same citations. Optimizer correctly skips clouds it doesn't model — no fabricated recommendations.
The math runs in Python. The LLM only writes.
Four stages, each owned by a separate module. The narrative layer receives findings with explicit IDs and is rejected if it omits citations. No invented numbers ever leave the engine.
Parse + anonymize
Auto-detect AWS CUR vs Azure export. Hash account/subscription IDs and drop PII tags at parse time — anonymization happens inside the parser, not as a downstream step.
Deterministic analysis
Service/region/month breakdown, anomaly detection on M-o-M deltas, idle-NAT inference from billing shape, untagged-spend governance signals.
LP-solved commitments
1-year no-upfront Compute SP sized to the minimum monthly OnDemand baseline per (family, region) via a pulp linear program. Conservative, citable.
Cited narrative + remediation
Claude writes the prose; the validator rejects any paragraph without a finding citation. Each finding gets Terraform + CLI artifacts attached deterministically from metadata.
Bills tell you a lot. They don't tell you everything.
We're explicit about what billing-derived analysis can and cannot do. If you want IAM audits or CIS coverage, those need a read-only role — different shape of product, different trust model.
What's in scope
- Service / region / month cost breakdown
- Month-over-month anomaly detection
- 1yr no-upfront Compute SP optimization (AWS)
- Idle NAT-gateway detection from billing shape
- Tagging hygiene / untagged spend share
- Reserved Instance ladder modeling
What's out of scope (and why)
- CIS / NIST / HIPAA / SOC 2 mapping — bills don't carry config
- Right-sizing without utilization data — CPU/mem isn't in a CUR
- Public S3 bucket detection — requires API access
- IAM / MFA / encryption checks — requires API access
- Azure RI / Savings Plan optimization — coming in v3