Compliance Tier
The Compliance Tier is designed for regulated enterprises (FinTech, Healthcare, Government) that cannot grant IAM access to third-party services due to security policies.
If your security team requires zero external access to your AWS accounts, Compliance Tier gives you all the power of CloudWise without granting live IAM access — no live AWS credentials required, and you choose exactly what's uploaded.
Key Features
365-Day Data Retention
Unlike the standard 7-day Air-Gapped Mode, Compliance tier retains your uploaded cost data for a full year, enabling quarterly and annual variance analysis.
| Tier | Retention Period |
|---|---|
| Free / Shield | 7 days |
| Compliance | 365 days |
Consistent Anonymization with a Client-Held Salt
Reusing the same anonymization salt across uploads gives you consistent entity correlation for trend analysis. Without it, anonymized IDs would change each upload, making it impossible to track the same resources over time.
The salt is yours — CloudWise never sees it. Because pseudonyms are derived from your salt, anyone holding the salt could reverse them. That's why the salt never leaves your side: CloudWise cannot re-identify your accounts or resources, even in principle.
How it works:
- Choose your own salt (generate one in the Anonymization Salt panel, or run
openssl rand -hex 16) - Store it in your own password manager or secrets manager — CloudWise never receives or stores it
- Pass it to the export/anonymizer scripts with
--salton every upload, soaccount-abc123always maps to the same anonymous ID - To start fresh, simply switch to a new salt (this breaks historical correlation, and CloudWise cannot recover the old mapping)
Quarter-over-Quarter (QoQ) Variance Reports
Compare costs across any two upload periods to identify trends, budget variances, and optimization opportunities over time.
Features:
- Select any two historical uploads for comparison
- View cost changes by service, account, region, or tag
- Identify spending trends and anomalies
- Export variance reports as CSV or PDF
🏷️ Cost By Tag Analysis
If you use AWS resource tags (e.g., Environment, Team, CostCenter), CloudWise surfaces tag-based cost breakdowns across the entire platform.
Cost By Tag works with any tags present in your AWS Cost and Usage Report. The more consistently you tag your resources, the more useful the breakdowns become.
Where you'll see tag data:
| Surface | What it shows |
|---|---|
| Workspace overview | "Cost by Tag" card — select a tag key to see top values by spend |
| Cost views | Group by any tag key, filter by tag values in Advanced Filters |
| QoQ Variance | Compare cost changes by tag value across billing periods |
How it works:
- Tags are automatically extracted from your CUR CSV during upload
- CloudWise discovers all available tag keys from your data
- Select a tag key from any dropdown to see the breakdown
- Works across all tiers (Dashboard card is available to everyone)
PDF Audit Reports
Generate professional audit-ready PDF reports for compliance documentation:
- Executive summary with key metrics
- Detailed cost breakdown by service
- Waste findings with remediation recommendations
- Month-over-month trend analysis
Getting Started
Step 1: Subscribe to Compliance Tier
- Go to Settings → Subscription in the CloudWise dashboard
- Select the Compliance tier ($99/mo or $799/year)
- Complete payment via Stripe
Step 2: Download the Export Script
# Download the CloudWise export script
curl -O https://cloudwise.dev/scripts/cloudwise-export.sh
chmod +x cloudwise-export.sh
Step 3: Run with Anonymization
# Run in AWS CloudShell or locally with AWS credentials
./cloudwise-export.sh --anonymize --output-mapping
The --output-mapping flag saves a local mapping file so you can reverse-lookup anonymized IDs.
To analyze resources across multiple AWS regions with anonymization:
./cloudwise-export.sh --regions us-east-1,eu-west-1,ap-southeast-1 --anonymize --output-mapping
All regions are bundled into a single ZIP. Global services are exported once.
Step 4: Upload to CloudWise
- Open Air-Gapped Mode (the offline path of the Connect flow) in CloudWise
- Upload your generated ZIP file
- View your cost analysis instantly
Step 5: Repeat for Trend Analysis
Run the export monthly or quarterly to build historical data for variance reports.
Pricing
| Plan | Price | Billing |
|---|---|---|
| Compliance | $99/mo or $799/year | Monthly or Annual |
The Compliance tier includes everything in Shield, plus:
- ✅ 365-day data retention (vs 7-day)
- ✅ Consistent anonymization across uploads (client-held salt)
- ✅ QoQ variance reports (with tag dimension)
- ✅ Cost By Tag across the Workspace overview, cost views, and QoQ Variance
- ✅ PDF audit report exports
- ✅ Up to 12 historical uploads
Frequently Asked Questions
Can I switch from Shield to Compliance?
Yes! You can upgrade at any time. Your Compliance tier starts immediately, and you'll be billed the prorated difference.
What happens to my data if I downgrade?
If you downgrade from Compliance to Shield, your data retention returns to 7 days. Uploads older than 7 days will be automatically deleted according to our retention policy.
Is my anonymization salt secure?
Yes — because you hold it, not us. Your salt is:
- Generated and kept entirely on your side (browser or your own tooling)
- Never transmitted to or stored by CloudWise
- Applied locally by the export/anonymizer scripts before any data leaves your network
This means CloudWise cannot reverse your anonymized identifiers — nobody without your salt can.
Can I rotate my salt?
Yes — generate a new one in the Anonymization Salt panel (or openssl rand -hex 16) and use it on future exports. Warning: Rotating your salt breaks correlation with historical uploads, and CloudWise cannot recover the old mapping. Only do this if you need to start fresh.
If I lose my salt, can CloudWise recover it?
No. CloudWise never sees the salt — that is the security guarantee. Store it in a password manager; without it, new uploads won't correlate with old ones.
Ready to upgrade? Go to Settings → Subscription in the CloudWise dashboard to get started.