Skip to main content

Trust Center

This page documents how Holori handles customer data, the architecture behind our BYOC (Bring Your Own Cloud) model for storing cloud cost data, and our security certifications.

Architecture overview​

Holori does not centrally store your cloud billing and usage data. Instead, Holori is deployed as a Bring Your Own Cloud (BYOC) application: collectors run inside your own cloud account, and the resulting cost data is written to a PostgreSQL database and S3 bucket that you provision and own, inside your own cloud perimeter.

The Holori application connects to that storage to compute dashboards, recommendations, and alerts, but the data itself never leaves your environment to be replicated on Holori's infrastructure.

Data flow​

  1. Collection — The cloud provider's native billing and usage is configured using methofs such as CloudFormation on AWS or equivalent, depending on provider. This sets up the AWS Cost and Usage Report, Azure Cost Management API, GCP Billing Export.
  2. Storage — Collected data is normalized to the FOCUS schema and written to your PostgreSQL instance and S3 bucket.
  3. Access — The Holori application authenticates against your storage using a read-only, scoped IAM role/service account that you create and control. Holori has no standing write or delete permissions on your billing data or on any other resource in your account.
  4. Revocation — Because access is entirely credential-based and scoped by IAM, you can revoke Holori's access at any time by deleting or disabling the role, with immediate effect.

Screenshot

Access control​

  • Holori's access to your environment is limited to the specific IAM permissions granted (read on the designated S3 bucket/prefix and PostgreSQL schema — no broader account access, no compute, no networking permissions).
  • No credentials are hardcoded; access is managed through your cloud provider's native IAM mechanisms (AWS IAM roles, Azure Managed Identities / service principals, GCP service accounts).
  • SSO sign-on is available for Google and Github accounts.

Encryption​

  • All connections between the Holori application and your storage are encrypted in transit via TLS.
  • All metadata that must be stored on Holori's end is subject to encryption at rest. Customers' cloud cost data is subject to each customer's security policy.

Network security​

  • There is a static IP range option by default for customers with strict network policies.

Data retention and deletion​

  • Because billing data is stored in the customer's own S3 bucket and PostgreSQL instance, retention and deletion are governed by the customer's own storage lifecycle policies, not by Holori.

Standards compatibility​

Holori is built on the FOCUS (FinOps Open Cost and Usage Specification) standard for cost data normalization, ensuring your data remains portable across tooling rather than locked into a proprietary schema.