Compliance Tier
The Compliance Tier is designed for regulated enterprises (FinTech, Healthcare, Government) that cannot grant IAM access to third-party services due to security policies.
If your security team requires zero external access to your AWS accounts, Compliance Tier gives you CloudWise's analysis without granting live IAM access: no live AWS credentials, and you choose exactly what's uploaded. Air-Gapped Mode runs up to 158 of the 186 waste checks and never executes fixes.
No connected AWS account. The Compliance plan never connects an AWS account: the connect screens and the API refuse a new connection and point you to Air-Gapped uploads. An account you connected before moving to Compliance stays listed, and its existing findings stay readable, and you can delete it, but CloudWise does not reconnect it or run fixes on it. Scanning it is paused while you are on Compliance: CloudWise stops scanning it and starts no new request for it, so no scheduled or on-demand scan, no cost backfill, no credential or permission check and no Savings page read, and none of the Cost Explorer requests they would bill to your account (see Cost Explorer charges on your bill). A scan that was already running when you moved can still finish. A fix you approved on Agentic that had not run when you moved does not run: CloudWise checks your plan right before it would run a fix, marks the fix failed with "remediation is not part of your current plan", makes no change in your AWS account and refunds its action credit. The account card on the AWS accounts page says so. Its findings and cost data stop at the last scan before the move. If you move back to Shield or Agentic, scanning resumes on the next scheduled run, with no reconnect. The role stays in your AWS account until you delete its CloudFormation stack.
Snapshots from earlier fixes. If you used Agentic before, a fix that deleted an EBS volume first took a snapshot of it, tagged with an expiry date (cloudwise:expires_at). CloudWise normally deletes such a snapshot after it expires, but while you are on Compliance it does not, because it makes no call into the account. The snapshots stay in your account, and AWS bills you for their storage, until you delete them yourself (look for the cloudwise:expires_at tag in the EC2 console) or move back to a plan that scans the account, after which CloudWise deletes the expired ones again.
No remediation. Remediation is not part of the Compliance plan: CloudWise makes no proposals and runs no fixes for a Compliance account. The Remediation page shows each finding's recommendation and the steps you apply yourself. If you used Agentic before, its remediation history stays readable on each finding, read-only; a proposal still waiting for approval from that time is not shown and expires on its own.
Key Features
365-Day Data Retention
Unlike the standard 7-day Air-Gapped Mode, Compliance tier retains your uploaded cost data for a full year, enabling quarterly and annual variance analysis.
| Tier | Retention Period |
|---|---|
| Free / Shield / Agentic | 7 days |
| Compliance | 365 days |
Consistent Anonymization with a Client-Held Salt
Reusing the same anonymization salt across uploads gives you consistent entity correlation for trend analysis. Without it, anonymized IDs would change each upload, making it impossible to track the same resources over time.
The salt is yours — CloudWise never sees it. Because pseudonyms are derived from your salt, anyone holding the salt could reverse them. That's why the salt never leaves your side. CloudWise cannot reverse a pseudonym without your salt. Some fields stay raw, so review the output.
How it works:
- Choose your own salt (generate one in the Anonymization Salt panel, or run
openssl rand -hex 16) - Store it in your own password manager or secrets manager — CloudWise never receives or stores it
- Pass it to the export/anonymizer scripts with
--salton every upload, soaccount-abc123always maps to the same anonymous ID - To start fresh, simply switch to a new salt (this breaks historical correlation, and CloudWise cannot recover the old mapping)
Quarter-over-Quarter (QoQ) Variance Reports
Compare costs across any two billing periods in your uploaded data to identify trends, budget variances, and optimization opportunities over time.
Features:
- Choose any two billing periods (months) that appear in your uploaded cost data; you need data for at least two different billing periods
- View cost changes by service, account, region, or tag
- Identify spending trends and anomalies
- Export variance reports as CSV or PDF
🏷️ Cost By Tag Analysis
If you use AWS resource tags (e.g., Environment, Team, CostCenter), CloudWise surfaces tag-based cost breakdowns across the entire platform.
Cost By Tag works with any tags present in your AWS Cost and Usage Report. The more consistently you tag your resources, the more useful the breakdowns become.
Where you'll see tag data:
| Surface | What it shows |
|---|---|
| Dashboard | Open the Cost breakdown panel, choose the Tag tab and pick a tag key to see the top values by spend |
| Cost Reports | Group by any tag key, filter by tag values in Advanced Filters |
| QoQ Variance | Compare cost changes by tag value across billing periods |
How it works:
- Tags are automatically extracted from your CUR CSV during upload
- CloudWise discovers all available tag keys from your data
- Select a tag key from any dropdown to see the breakdown
- Tag grouping in QoQ Variance reports needs Compliance
PDF Audit Reports
Generate professional audit-ready PDF reports for compliance documentation:
The PDF audit report is the QoQ variance report as a PDF:
- An executive summary: totals for the two billing periods, with absolute and percentage change
- A variance table grouped by service, account, region or tag
Getting Started
Step 1: Subscribe to Compliance Tier
- Go to Settings → Subscription in the CloudWise dashboard
- On the plan page choose Get Compliance ($99/mo or $799/year)
- The button opens the contact form, so you arrange the Compliance plan with CloudWise rather than paying through the self-serve Stripe checkout
Step 2: Download the Export Script
# Download the CloudWise export script and verify its checksum
curl -sLO https://cloudcostwise.io/scripts/cloudwise-export.sh
curl -sL https://cloudcostwise.io/scripts/SHA256SUMS | grep cloudwise-export.sh | (sha256sum -c 2>/dev/null || shasum -a 256 -c)
chmod +x cloudwise-export.sh
--anonymizeEarlier versions left resource names and IDs in the ZIP's file names (before 1.14.0), key pair names, master usernames, database names, CloudFront aliases, descriptions and other fields in the files (before 1.15.0), some short or AWS-word resource names inside ARNs, host names, s3:// URIs and embedded JSON (before 1.28.2), names found only in ARNs and hundreds of other string fields (before 1.28.4), and fields CloudWise doesn't read (before 1.29.0). Later versions are still not complete: some fields stay raw, so review the output before you upload it. See the security notices for file names and fields for what was exposed and how to delete earlier uploads.
Step 3: Run with Anonymization
# Run in AWS CloudShell or locally with AWS credentials
./cloudwise-export.sh --anonymize --output-mapping
The --output-mapping flag saves a local mapping file so you can reverse-lookup anonymized IDs.
To analyze resources across multiple AWS regions with anonymization:
./cloudwise-export.sh --regions us-east-1,eu-west-1,ap-southeast-1 --anonymize --output-mapping
All regions are bundled into a single ZIP. Global services are exported once.
Step 4: Upload to CloudWise
- Open Air-Gapped Mode (the offline path of the Connect flow) in CloudWise
- Upload your Cost and Usage Report (CUR) CSV, which is required (CloudWise will not start an upload without it), and your generated ZIP file, which waste detection needs
- View your cost analysis once the upload finishes processing
Step 5: Repeat for Trend Analysis
Run the export monthly or quarterly to build historical data for variance reports.
Pricing
| Plan | Price | Billing |
|---|---|---|
| Compliance | $99/mo or $799/year | Monthly or Annual |
From Shield, Compliance keeps what works from your uploads: budget alerts, the email and Slack waste digests, and Prometheus metrics. For your Air-Gapped uploads it does not include the Shield features that need a connected AWS account (an account connected before you moved to Compliance gets none of them either: its scans are paused, as described above):
- No daily scheduled scan, and no on-demand scan
- No anomaly detection or anomaly alerts
- No stale-data reminders (they watch a connected account's cost feed)
It adds:
- ✅ 365-day data retention (vs 7-day)
- ✅ Consistent anonymization across uploads (client-held salt)
- ✅ QoQ variance reports (with tag dimension)
- ✅ Tag grouping in QoQ Variance (the Dashboard cost breakdown and Cost Reports group by tag on every plan)
- ✅ PDF audit report exports
- ✅ Up to 12 historical uploads
Frequently Asked Questions
Can I switch from Shield to Compliance?
Yes! You can upgrade at any time. Your Compliance tier starts immediately, and you'll be billed the prorated difference.
What happens to my data if I downgrade?
If you downgrade, new uploads are kept for 7 days and only your latest upload is kept: your next upload replaces the earlier ones, which are hidden at once and then deleted. Upload history and QoQ variance reports are no longer available.
Is my anonymization salt secure?
Yes — because you hold it, not us. Your salt is:
- Generated and kept entirely on your side (browser or your own tooling)
- Never transmitted to or stored by CloudWise
- Applied locally by the export/anonymizer scripts before any data leaves your network
This means CloudWise cannot reverse your anonymized identifiers — nobody without your salt can.
Can I rotate my salt?
Yes — generate a new one in the Anonymization Salt panel (or openssl rand -hex 16) and use it on future exports. Warning: Rotating your salt breaks correlation with historical uploads, and CloudWise cannot recover the old mapping. Only do this if you need to start fresh.
If I lose my salt, can CloudWise recover it?
No. CloudWise never sees the salt — that is the security guarantee. Store it in a password manager; without it, new uploads won't correlate with old ones.
Ready to upgrade? Go to Settings → Subscription in the CloudWise dashboard to get started.