Cost Allocation & Showback Platform  ·  View 21 of 22  ·  7 · Assurance

Security Trust Zones

Cost data discloses architecture, headcount and roadmap. Four zones, and no human standing access to the data zone.

Editable source SVG draw.io All views
Provider billing boundary — outside our control AWS billing export Azure Cost Management Google Cloud billing Vendor invoice portals Corporate access zone — authenticated humans Engineering lead own team only Product owner own line Finance & FinOps estate-wide Entra ID MFA enforced Application zone — private endpoints, no public ingress Query & statement API scope-filtered Dashboard Batch runners workload identity Policy & ownership admin separate role Restricted data zone — no human standing access Raw landing zone immutable blobs Cost fact store Statement & audit store 7 years Key Vault CMK export role team scope estate scope workload id approved, audited Trust Zones — Cost Data Discloses Architecture, Headcount and Roadmap External / third party Person or role Security / platform Interface / broker Application we own Data store batch synchronous The credentials that read a provider's bill cannot reach that provider's workloads. That separation is what lets a read-only measurement platform hold estate-wide credentials at all. v 1.0 · owner Platform Architecture · date 2026-09

Decisions

  • Billing credentials are scoped to export read only and cannot reach the provider's workloads
  • Reads are scoped by accountability: a team lead sees their team, a product owner their line, finance the estate
  • Write access to ownership and policy is a separate role from read access — those two surfaces move money
  • No standing human access to the restricted data zone; batch runners use workload identity

Audit

  • Policy changes, ownership changes, publications, restatements, dispute actions and bulk exports are recorded for 7 years
  • Cross-team reads are logged even when they are permitted

Encryption

  • Customer-managed keys at rest with rotation that does not require re-ingestion; modern TLS in transit throughout
◀  The Monthly Close Loop All views Identity and Access Flow  ▶
Solution Architecture v1.0 · Microsoft Azure · Cost & Efficiency Architecture · 2026-0921-security-trust-zones