Security And Data Handling
OptiGPU is built around read-only cloud evidence, workspace-scoped access, encrypted credentials, and explicit operational limits. This page describes what is true today.
Last updated: July 6, 2026
OptiGPU does not claim SOC 2, ISO 27001, PCI certification, or security badges before they are complete. Stripe-hosted Checkout handles payment collection for paid plans.
Read-Only AWS IAM Policy
OptiGPU needs billing and utilization evidence only. Use a dedicated role with an external ID and avoid write permissions. Scope S3 resources to the CUR bucket in production.
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"s3:GetObject",
"s3:ListBucket",
"cur:DescribeReportDefinitions",
"ce:GetCostAndUsage",
"cloudwatch:GetMetricData",
"cloudwatch:ListMetrics"
],
"Resource": "*"
}
]
}GCP Read-Only Access
Use a service account limited to BigQuery billing-export read access, BigQuery Job User, and Monitoring Viewer.
Azure Read-Only Access
Use an app registration limited to Storage Blob Data Reader on the Cost Management export container and read-only monitoring access.
CoreWeave Read-Only Access
Use account/API credentials that can read billing usage and pricing evidence without infrastructure write permissions.
Data Stored
- Account profile: name, email, authentication state, workspace membership, and role.
- Billing evidence: AWS CUR rows, GCP BigQuery billing rows, Azure Cost Management rows, CoreWeave billing rows, or normalized cost records needed to calculate reports.
- Report files: PDF, CSV, data exports, formulas, and provenance references.
- Integration metadata: encrypted provider credentials, export locations, status, and sync timestamps.
- Operational logs: request IDs, workspace IDs where needed for access control, sanitized errors, and webhook delivery state.
Retention
Customer report data is retained while the workspace is active unless deletion is requested or a contract sets a shorter retention period. Operational logs are kept for security monitoring and billing reconciliation according to deployment policy.
Encryption
Production traffic uses HTTPS. Cloud integration credentials are encrypted before storage. Session cookies are HttpOnly, and backend routes enforce workspace membership before returning report, billing, or integration data.
Subprocessors
Actual subprocessors depend on the deployment and features enabled for a customer.
Incident Contact And SLA
Report suspected vulnerabilities or customer-impacting security issues to [email protected]. OptiGPU targets acknowledgement within one business day for security reports. Contractual response times are set in the customer agreement.