Hosted today, with a self-hosted package to follow

The hosted service runs at app.getfinops.cloud, and each workspace gets its own address under it. Requests pass through CloudFront to a private load balancer, then to the backend and dashboard containers on Amazon ECS. Billing is handled through Stripe.

Workspaces share one PostgreSQL database on Amazon RDS, encrypted at rest and not reachable from the internet. Your workspace comes from your signed session, and the application uses it to scope what you can read. The platform can also give a workspace its own backend and dashboard containers; its data still lives in the shared database.

• Cross-account role. A CloudFormation template creates an IAM role that trusts GetFinOps’ AWS account and requires your workspace’s External ID. GetFinOps assumes it for temporary credentials, so no access keys are stored. It is read-only unless you turn on EnableRemediation, which adds a short list of write permissions.
• Deploy in account. A CloudFormation stack runs a collector in your account, daily by default, and writes snapshots to an encrypted S3 bucket there. The bucket policy lets GetFinOps’ AWS account read them. There is no role GetFinOps can use to make changes, so this method is observe-only.
• Google Cloud. You create a service account with viewer roles for Recommender, Compute, Cloud SQL, Storage, Monitoring, GKE and BigQuery data, plus BigQuery Job User so it can run the billing queries, and provide its key, which is stored encrypted.

The AWS package is a CloudFormation template that runs the backend, dashboard and background worker in one container, as a single ECS Fargate task in your VPC. It is not listed on AWS Marketplace, and its container image is not published yet. It creates:

• RDS PostgreSQL 16, encrypted, not publicly accessible, with seven days of automated backups;
• ElastiCache Redis for the job queue;
• a customer-managed KMS key with rotation, used for the secrets and the log group;
• Secrets Manager entries for the database password, the JWT secret and, if you supply one, the license key;
• a security group that opens the app ports only to a CIDR range you choose, 10.0.0.0/8 by default.

A GCP Marketplace Kubernetes app is in progress. Its Deployment Manager template describes a GKE Autopilot cluster, Cloud SQL for PostgreSQL 16 with backups, Memorystore Redis with authentication, Secret Manager secrets, and a Pub/Sub subscription for marketplace entitlement events. The templates it imports and the Helm chart that installs the platform are not written yet, so it cannot be deployed today.

Its Helm values set a single replica, a non-root user, a read-only root filesystem and no Linux capabilities.

A self-hosted install reads a license key: a JWT signed with Ed25519, checked against a public key that ships with the product. The signing key does not. The key sets the plan. Without one the install still starts, on the free plan: scans, findings and reports work, and approving or running remediation is refused until a license is installed. A license can also be installed later in Settings → License, which keeps it encrypted in the install’s database; a key set at launch, such as the AWS template’s LicenseToken parameter, takes precedence. When a license passes its end date, it enters any grace period it carries, then expires. After that you can still read what is there, the plan drops to free, and starting a scan from the app and all remediation, including approvals, the auto-execute endpoint, manual rollback and automatic execution after a scan, are refused until a valid key is installed. Scheduled scans keep running.

Marketplace usage is measured in connected cloud accounts, completed scans and active users. The current package does not yet send that usage to AWS or Google.

• On an install started with a license key, the install reads the AWS account it runs in with its own task role, so there is no cross-account role or External ID. The template grants that role read access to Cost Explorer, Config, EC2, RDS and CloudWatch.
• Daily scheduled scans are off until you turn them on, in both packages.
• Your plan comes from the license key, and without one the install is on the free plan. An expired or invalid key blocks starting scans from the app and all remediation.
• On an install started with a license key, there is no in-app workspace deletion (you remove the stack), and the in-app “Report a problem” button is not shown.
• Slack approvals ship switched off.
• MFA can use the built-in authenticator-app option, which needs no outside vendor.

• This page does not confirm that a marketplace listing is live.
• A self-hosted AWS install does not read other AWS accounts, and cannot make changes until you add write permissions to its role.
• Deploy in account does not keep your data out of GetFinOps, and it cannot make changes.
• Self-hosting does not keep AI features inside your account: they call Anthropic’s hosted API.
• The current package does not yet send marketplace usage to AWS or Google.
• No option makes changes in GCP; remediation runs in AWS only.
• The hosted service does not promise that your data stays in a particular region.