Migration, optimization, and rationalization intelligence.

Those are FinOps tools for ongoing cloud spend management once you are already in cloud. Cloud Intelligence is an assessment platform for migration, arbitrage, rationalization, and M&A diligence, the work that happens before workloads move (or before they get cut). Different buyer, different workflow, different output (a wave plan and a defensible TCO model, not a monthly chargeback report).

We sit alongside, and we are explicitly neutral. AWS Transform shipped September 2025 and optimizes for AWS landing zones. Azure Copilot Migration Agent shipped the same month and optimizes for Azure. Both are useful inside their respective clouds. Neither will tell you to pick the other. Cloud Intelligence scores AWS, Azure, GCP, and OCI on the same matrix, weighted by your scenario, we have no landing-zone quota.

CSV import works today and is the path most engagements use. ServiceNow and Device42 connectors are on the roadmap. The XLSX round-trip with the v5.1 Excel template covers the cases where your client gives you a spreadsheet and wants the answer back in the same format.

Each engagement runs in its own isolated workspace. The database itself refuses to return one client’s data to a different client’s session, this is enforced at the database layer, not just in the application code, so even a software bug cannot leak data across engagements.

Specifically:

• In flight: All traffic uses TLS 1.3, the same encryption standard banks and payment networks use. The connection negotiates TLS 1.3 with modern ciphers; older protocols are refused.
• At rest: The storage layer is encrypted by the cloud provider (Oracle Cloud Infrastructure block-volume encryption). A physically removed disk reveals nothing readable.
• Authentication: Access is gated by per-engagement Bearer tokens. Tokens are stored as salted SHA-256 hashes, the database does not retain the raw token. Each token can be rotated or revoked instantly without affecting other engagements.
• Authorization: Postgres Row-Level Security policies are FORCED on every table that holds engagement data (15 tables verified). A query without engagement context returns zero rows by policy; the database, not the app, is the boundary.
• Brute-force protection: Login attempts and authenticated API calls are rate-limited per IP and per engagement. Repeated failed logins lock out the source within seconds.
• Browser hardening: Strict Content-Security-Policy (CSP) blocks script injection. HSTS forces HTTPS. X-Frame-Options blocks click-jacking. Permissions-Policy disables camera, microphone, geolocation, and FLoC tracking.
• Backups and recovery: A full database dump runs every night with 30-day retention. A weekly restore test actually restores the most recent dump into a scratch database and verifies row counts, if a backup is silently broken, the next weekly test catches it.
• Tracking: No Google Analytics, no Facebook pixel, no HubSpot, no Segment, no Amplitude, no telemetry of any kind. Your engagement data is never sent to a third party. Only library code (Chart.js, Cytoscape, html2canvas) loads from public CDNs, and the CSP restricts even those origins.
• Export rights: Every byte you put in is exportable at any time as branded PDF, CSV, Excel, or REST API. Your data is yours, irrevocably.

Need to hand this answer to your security team for review? Get the long-form security brief.

Yes. Branded PDF report, CSV of every table, XLSX round-trip with the v5.1 Excel template, and REST API. Your assessment outputs are yours; we never gate the export.

Scope is set per engagement, not per tier. There is no hardcoded app or server cap. Whether the engagement covers 50 apps for a mid-market carve-out or 5,000 apps for a Fortune 500 multi-year migration, the tool runs at the size of the work. The shape of the engagement is something we agree before we start; talk to us about the assessment in front of you.