Built to run inside your boundary.
FinOpsRelay is one container with its own analytics engine, its own scheduler and its own sign-in. Your cost data, credentials and reports stay on infrastructure you control.
Every report is SQL you can read
Cost lands in one FOCUS-shaped table. Each provider's own export schema is a view over it, so a query written against AWS CUR, Azure Cost Management or the Google Cloud BigQuery export runs unchanged.
Published datasets, plus your own.
Every dataset a report or dashboard can query, with its schema and a live preview. Build a custom dataset by picking columns and filters, or by writing a SELECT, and load data through the API.
Standard, saved, custom and shared.
Curated reports to start from, filtered by persona. Copy one and change it with pickers, or write the SQL yourself. Every query runs read-only, one statement at a time, under a deadline.
- Persona filters for practitioners, leadership, engineering, finance and procurement
- Schedule any report as a subscription with a chart attached
Fourteen dashboards on day one.
Cost Overview, Cost Optimization, AI & Tokenomics and Realized Savings, scope dashboards for SaaS and Data Center, and eight persona dashboards behind a single switcher.
KPIs with Crawl, Walk and Run targets
The FinOps Framework KPI catalog is computed live for the last complete month, scope-aware, with its formula beside each value. Executive Strategy Alignment puts the headline KPIs on one screen, and the Framework sets these maturity targets.
| KPI | Crawl | Walk | Run |
|---|---|---|---|
| Commitment Utilization | — | 75% | 80% |
| Commitment Coverage | — | 75% | 90% |
| Tag Compliance (BU) | — | — | 90% |
| Cost Allocation Rate | 70% | 85% | 90% |
| Forecast Variance | 20% | 15% | 12% |
Ask in plain English. Get the SQL back.
Type a question such as "Which subscriptions had the biggest cost increases?" Intelligent Assist writes the query, runs it, and answers with a chart or table. Open the generated SQL, then save it as a report.
It is off until you connect a model provider, and the page says plainly that sampled rows are sent to that provider.
- OpenAI
- Amazon Bedrock
- Google Vertex AI
- Gemini
- Microsoft Foundry
Ship a whole practice in one file.
A content package bundles reports, dashboards, policies, saved queries and custom datasets under a name and version. Export it as JSON, import it into another tenant, and assign it to an account group, a partner customer or the whole tenant.
- Eight built-in packages, from FinOps Framework Starter to FinOps for AI
- Imports are re-validated item by item
- Your edits to a built-in package survive a restart
What runs while you sleep
A scheduler wakes every 20 seconds and runs whatever is due. Cost collection runs per account on its own cadence, from every 15 minutes to every 24 hours. Every default time can be overridden, or a job run by hand, from Components › Schedules.
Daily, UTC
- 03:00
- Azure CMDB from Resource Graph
- 03:30
- Azure governance: secure score, Defender, policy, Advisor
- 04:00
- SaaS AI cost and usage, Microsoft 365 licensing
- 05:00
- Azure billing sync: commitments, price sheet, invoices, MACC
- 06:00
- Microsoft 365 compliance reports
- 07:30
- Snowflake usage, cost and findings
- 07:45
- Google Cloud FinOps collection
- 08:00
- Azure DevOps organizations
- 08:30
- VMware CMDB sweep
- 09:00
- Azure compliance checklist sweep
- 17:30
- SaaS AI engagement snapshots
Weekly
- Sat 07:00
- Optimization Engine sweep across Azure
- Sun 07:00
- AWS Compute Optimizer and Google Cloud Recommender rightsizing
Monthly
- Day 2
- Partner customer statements for the previous month
- Day 5
- KPI snapshot for the Framework trend column
- Day 19
- Measured Azure carbon emissions
Who can sign in, and what they can see
Three sign-in modes
Local accounts with PBKDF2-SHA256 at 600,000 iterations and a 12-character minimum, SAML 2.0 single sign-on, or Microsoft Entra through App Service authentication.
SCIM provisioning
SCIM 2.0 users and groups for Entra ID. The bearer token is compared in constant time, and the endpoint refuses every call until a token is configured.
Encrypted credentials
Provider secrets are stored with AES-256-GCM and a fresh nonce on every write, and are never returned to the browser.
Role-based access
Roles grant view or manage per area of the app. An administrator can preview exactly what another user sees before granting it.
Scoped to the unit
An organizational unit's filter is applied inside the query. A record outside the unit returns 404, so the response does not confirm it exists.
Read-only SQL
User SQL runs on a read-only connection, one SELECT at a time, against published datasets only, under a wall-clock deadline.
One container, one writer, on purpose.
The analytics engine is SQLite with a single writer, so FinOpsRelay runs as one instance and scales up rather than out. Run it with Docker anywhere, or use the Azure reference templates included in the package.
- Azure App Service on Premium v3 with a Linux container
- Public network access disabled; inbound only through a private endpoint
- HTTPS only, TLS 1.2 minimum
- Secrets held in Key Vault and read through a managed identity
- Data on an Azure Files share mounted at /data
- Separate prod and dev plans running the same image digest
Ten themes, light and dark
Pick the look that suits the job. A rising cost reads as the warning color in every theme, and ten charts can switch to an optional 3D view.