Azure Cost Optimizer reads your Azure billing and resource configuration to generate a health score and cost-reduction recommendations, and can — only with your explicit confirmation — apply a small set of low-risk changes on your behalf. This page describes how we protect access to that connection and the data it produces.

Authentication

Sign-in runs through Microsoft Entra External ID (a customer identity tenant dedicated to this product) using standard OAuth2/OIDC — we never see or store your password. Every server request is authorized against a JSON Web Token verified against Microsoft's own signing keys.

Your Azure credentials

When you connect an Azure environment, the app registration's client secret is encrypted with AES-256-GCM before it ever reaches storage, using a key held only in the application's server environment — never in the database alongside the ciphertext, never in application logs, never returned to the browser in full (only the last four characters are shown, to confirm which secret is active). Azure Lighthouse delegation, where available, avoids sharing a secret with us at all.

By default, the credentials we ask for carry only Reader and Cost Management Reader access — enough to analyze your estate, not to change it. One-click actions (applying a storage lifecycle policy, suspending or deleting a resource group) require a separate, explicitly-granted write role, and destructive actions carry their own additional safeguards — see below.

Data isolation

Every customer's data — connected environments, discovered resources, cost history, recommendations, and audit trail — is scoped to that customer's account at the application layer, on every read and every write, not left to a shared database permission model. Automated tests specifically cover this isolation boundary, including for the case of a partner/reseller account managing several client accounts (where the same isolation guarantee must hold between clients, not just between unrelated customers).

What we don't process

We only ever read Azure billing and resource-configuration metadata — resource names, types, tags, cost figures, and configuration flags like backup/HA settings. We never access the data inside your applications or databases, and we don't request the permissions that would let us.

Infrastructure

The application runs entirely on Microsoft Azure — Azure App Service (Linux), Azure Database for PostgreSQL Flexible Server (itself authenticated via Microsoft Entra, with no stored database password), and Azure Blob Storage for the small amount of user-uploaded content (profile pictures, and — for paid plans — partner branding assets). All traffic runs over HTTPS/TLS.

Patch cadence

Dependencies are scanned for known vulnerabilities on every change (CI runs npm audit and fails the build on any high or critical finding). Platform runtime and OS-level patches are managed by Azure App Service's own maintenance process. High/critical application vulnerabilities are patched and deployed within 5 working days of disclosure; other findings are addressed on the next routine release.

Auditability

Every one-click action we take on your behalf, and every account/tenant/credential/ role-management event, is written to an audit trail visible to your account admins. Deleting a resource group always requires a two-person approval — one admin requests it, a different admin must approve, and no one (including us) can bypass that — see the acceptable-use terms below.

Sub-processors

Microsoft Azure (hosting, database, storage, identity). Where enabled on your plan: Paddle (billing, as merchant of record — Paddle never shares full card details with us), PostHog EU (product analytics), and Microsoft Azure Communication Services (transactional email — invites, alerts, billing notices). We will give you at least 30 days' notice before engaging a new sub-processor that will process your data, and you may object on reasonable data-protection grounds — if we cannot resolve your objection, either party may terminate the affected service.

This section describes, in draft form, the terms under which The Data Innovation Hub ("we", "us") processes personal data on behalf of a customer ("you") using Azure Cost Optimizer. It is intended to become a signable annex to our commercial terms — until then, treat it as a description of current practice, not a binding agreement.

Roles

For the billing/configuration metadata described in the security overview above, you are the data controller and we are the data processor, acting only on your instructions (as expressed through the app's own configuration — which environments are connected, which actions are confirmed). Where you connect and manage a client's Azure environment as a Partner/MSP customer, we act as data processor directly to that end client for their billing/configuration metadata — not as a sub-processor engaged by you on their behalf — and this DPA extends to cover our processing of each end client's data on those terms.

Categories of personal data

Account holder name and email (for sign-in and audit attribution); no data originating from inside your Azure workloads. We do not knowingly process special categories of personal data.

Location

All infrastructure is provisioned in Microsoft Azure's UK regions. Sub-processors (Paddle, PostHog EU, Microsoft) are listed above and may process data under the UK International Data Transfer Addendum or EU Standard Contractual Clauses where a sub-processor operates outside the UK/EU.

Security incident notification

If we become aware of a breach of security leading to accidental or unlawful destruction, loss, alteration, or unauthorised disclosure of your data, we will notify you without undue delay and in any event within 48 hours of becoming aware, with the information reasonably available to us at that time, to support your own regulatory notification obligations.

Audit

On reasonable written notice, no more than once per 12 months (or following a security incident), we will provide you with a completed security questionnaire and reasonably available evidence of the controls described in the Security overview above. Where reasonably necessary, we will discuss additional audit arrangements on a case-by-case basis.

Personnel confidentiality

Anyone with access to your data on our behalf is bound by a confidentiality obligation covering that data.

Retention & deletion

Connected-environment data is retained for as long as your account remains active. On account closure, we will delete or anonymize personal data within 90 days, except where retention is required for legal, audit, or dispute-resolution purposes (e.g. the audit trail and billing records, which we retain per our stated retention periods and your applicable statutory limitation period).

Your rights

If we receive a request directly from one of your users to exercise a data subject right (access, correction, deletion, portability), we will forward it to you promptly — and in any event within 5 working days — so you can respond as controller, unless you've asked us to handle a specific category of request directly. We will provide reasonable assistance to help you respond within the timeframe required by applicable law.

What the app can do

With credentials you explicitly grant and connect, Azure Cost Optimizer reads your Azure billing and resource configuration, and — only when you click to confirm a specific recommendation — applies a narrow, named set of changes: storage lifecycle policies, suspending or resuming a resource group's Postgres/Container App resources, and (only for accounts with the relevant approval granted) deleting a resource group already fully suspended.

What it will never do

• Take an irreversible or destructive action without your explicit, per-action confirmation.
• Delete a resource group containing anything tagged as production, or anything not already fully suspended.
• Access data inside your applications, databases, or storage account contents.
• Share your data with another customer, including between a partner account and its clients.

Destructive actions

Whole-resource-group deletion always requires two-person approval within your own account: one company admin requests it, a different company admin must approve before it executes, and no one — including your own SuperAdmin, and including us — can bypass that. We recommend never requesting this on a resource group containing real production data without a tested backup/restore plan of your own; deletion of data stores (databases, storage accounts) inside a resource group is not recoverable through this application.

Your responsibilities

You are responsible for granting only the access you intend us to have (Reader/Cost Management Reader by default; write access only if you want one-click actions), for reviewing recommendations before confirming them, and for your own backup/recovery posture on anything you allow this app to modify or delete.

Fair use

Plans are metered by connected environment/subscription count and, for automation features, by scheduled-analysis frequency — see your plan's entitlements. We may suspend an account that attempts to circumvent these limits or that uses the service in a way that materially degrades it for other customers.