A company that already runs AWS. The buyer is a platform lead, a FinOps lead, or the person who can approve a line on the AWS bill. Paid plans are on AWS Marketplace, billed annually. Individual is 30 scans on one account so that person can see a report first. It is not a personal-finance app.

Yes. We use standard AWS read-only APIs and a read-only IAM role you deploy. Nothing is changed in your accounts unless you act on findings yourself.

SecurityAudit is the read-only baseline AWS maintains for auditors: Describe, List, and Get on resource configuration. AWS keeps it current as services ship, so new rules rarely need a role update. It does not grant reading S3 object contents or secret values. A small inline policy adds the read-only calls it lacks, such as Cost Explorer, CloudWatch metrics, Cost Optimization Hub, and Pricing.

We run deterministic rules across 30+ services and every enabled region (59+ detection types). After you connect an account, the dashboard lists every check that ran.

Yes. Connect an Organization or as many accounts as you need. Individual is one account. Startup and above are unlimited accounts, billed by credits, not by account count. Register them in the app or through the public API. The API is how you onboard a large org in one pass. The read-only IAM role still deploys per account (CloudFormation, Terraform, or StackSets).

1 credit is 1 resource on one scan. Credits pool across every account you connect. Unlimited accounts from Startup. On a weekly schedule, Startup (15,000 credits) covers about 3,500 resources, Business (50,000) about 12,000, Enterprise (100,000) about 25,000. Daily scans use more credits. Prices are monthly, billed annually. Individual is 30 free scans on one account, no card. AWS Marketplace is how procurement pays.

Email carries a concise weekly digest you can forward. Slack and Teams get scan alerts, including how many findings cleared since the last complete scan. The full web report, trends, and drill-downs live in the dashboard. When an account's Bedrock bill is at least $10 in the month, the report and the executive digest show which model and which token type took it, with a weekly grade for cache efficiency, model mix, and failed requests. Only prompt cache writes that are never read back count as recoverable waste. Navi, on Business, sits on that report. On Enterprise, the executive digest can also post to a Telegram Channel. Trends follow each unused AWS resource over time. Realized savings are findings that actually cleared.

Yes on Startup and above. Admins mint an expiring API key in Team settings. The public API creates, updates, and removes AWS accounts, including schedule, notifications, and tags. You can also trigger a scan and poll its status. A script of PUT calls is enough for a hundred accounts. The read-only IAM role is still deployed in each AWS account. Individual stays on the dashboard.

A later complete scan no longer sees it. Delete it, attach it, or whitelist it: same signal. The dashboard calls that cleared. Incomplete scans do not mark missing regions as cleared.

Navi is on Business and Enterprise, off until you enable it in Settings. It is grounded in your scan results and in-app report context, not open-web search. Optional memory is opt-in. On Enterprise, a Settings note covers org facts the scan cannot see.

Product data stays in AWS eu-west-1 (Ireland). ZOPH.IO is a French company. People with access to production are in the EU. Cost Explorer calls run in your account; AWS serves that API from us-east-1. Navi is off until you enable it. Only then is a findings snippet sent to OpenAI, under Standard Contractual Clauses. Request a signed DPA at [email protected]. Subprocessors, deletion, and the operator: unusd.cloud/security.

We do not use your prompts or scan data to train models. Navi is off until you enable it. Then it sends scan-grounded context to OpenAI, whose API terms state that API data is not used to train their models. What we store, subprocessors, deletion, and how to request a DPA: unusd.cloud/security.