Security

Security and data handling

Updated August 8, 2026

OptiGPU reads billing and utilization evidence through read-only access, keeps it scoped to your workspace, and never changes anything in your cloud. This page describes what is true today.

How your data flows

  1. Your cloudBilling export and GPU metricsCUR in S3 · BigQuery export · Cost Management export · CoreWeave usage
  2. Read-only accessA role or key you createRead permissions only · credentials encrypted before storage
  3. OptiGPU workspaceReports and evidenceMembership checked on every request · HTTPS · HttpOnly sessions

Nothing flows back. OptiGPU does not request source code, model weights, training data, or cloud write permissions, and it does not make infrastructure changes. A billing CSV you upload follows the same path without the access step.

Permissions we ask for

ProviderAccessScope
AWSDedicated IAM role with an external IDRead the Cost and Usage Report bucket, Cost Explorer and CloudWatch GPU metrics. Scope S3 resources to the CUR bucket in production. No write permissions.
Google CloudService accountBigQuery billing-export read access, BigQuery Job User and Monitoring Viewer. Nothing else.
AzureApp registrationStorage Blob Data Reader on the Cost Management export container and read-only monitoring access.
CoreWeaveAccount or API credentialsRead billing usage and pricing evidence, without infrastructure write permissions.

The AWS policy, for review before you create the role:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "s3:GetObject",
        "s3:ListBucket",
        "cur:DescribeReportDefinitions",
        "ce:GetCostAndUsage",
        "cloudwatch:GetMetricData",
        "cloudwatch:ListMetrics"
      ],
      "Resource": "*"
    }
  ]
}

What we store

  • Account profile: name, email, authentication state, workspace membership, and role.
  • Billing evidence: AWS CUR rows, GCP BigQuery billing rows, Azure Cost Management rows, CoreWeave billing rows, or normalized cost records needed to calculate reports.
  • Report files: PDF, CSV, data exports, formulas, and provenance references.
  • Integration metadata: encrypted provider credentials, export locations, status, and sync timestamps.
  • Operational logs: request IDs, workspace IDs where needed for access control, sanitized errors, and webhook delivery state.

Retention and encryption

Customer report data is retained while the workspace is active unless deletion is requested or a contract sets a shorter retention period. Operational logs are kept for security monitoring and billing reconciliation according to deployment policy.

Production traffic uses HTTPS. Cloud integration credentials are encrypted before storage. Session cookies are HttpOnly, and backend routes enforce workspace membership before returning report, billing, or integration data.

Compliance status

OptiGPU does not hold SOC 2, ISO 27001 or PCI certification today and does not claim security badges before they are complete. Payment collection for paid plans runs on Stripe-hosted Checkout. The data processing agreement sets out processing terms.

Subprocessors

Actual subprocessors depend on the deployment and features enabled for a customer.

VercelFrontend hosting and edge delivery
RenderBackend API runtime
NeonCustomer workspace, billing, and application database hosting
CloudflareEncrypted report and evidence-artifact object storage
StripeHosted checkout, billing portal, and subscription management
Twilio SendGridTransactional email and report/digest alerts
SentryError monitoring with redaction controls
OptiGPU first-party product analyticsConsent-gated usage events where configured

Reporting a security issue

Report suspected vulnerabilities or customer-impacting security issues to [email protected]. OptiGPU targets acknowledgement within one business day for security reports. Contractual response times are set in the customer agreement.

Security | OptiGPU