unusd.cloudunusd.cloud
// Read-only AWS scans · weekly digest

Find the resources
no one is using.
Before finance
does.

Fixed detection rules on read-only AWS APIs. Waste and idle resources in a weekly email, with the full report and Navi in the app. Read-only. 5-minute setup.

EmailEmailSlackSlackMicrosoft TeamsTeamsTelegramTelegram
Start free scan→See what we detect
30 free scans · no credit card
700+ AWS orgs50+ detection rulesstandard AWS read-only APIs
inbox · weekly digest09:00 CET
unusd.cloud<digest@unusd.cloud>to amelie@acme.io
Weekly scan · acme · $4,812/mo of waste detected
6 accounts · 14 regions · 50+ rules
Top findings this week$/month
EBS
unattached volumes · 37
$1204
EC2
idle instances · 14
$968
SM
idle endpoints · 1
$480
RDS
stopped > 7d · 4
$312
NAT
low throughput · 2
$134
NAVI·insight
93% of this week's waste lives in acme-staging. Most of it is EBS volumes detached > 30 days. One whitelist rule could cut your digest noise by half.
next scan: Mon 09:00

Sample digest (summary by email). Full web report and Navi live in the app. Delivered Monday 09:00 in your timezone.

trusted by teams scanning 2,400+ AWS accounts · 30k+ scans run · $2.8M+ waste surfaced · listed on AWS Marketplace

Born from AWS cost audits for teams like ENGIE, Enedis, and Formance.

// How it works
01

Deploy a read-only role

CloudFormation, Terraform, or StackSets. You inspect the template first.

02

We scan every region

30+ services, 50+ rules. Nothing changes in your account.

03

Digest, then the app

Weekly email you can forward. Full report and Navi when you want the detail.

// Detections

50+ rules. Real ones. Battle-tested.

50+ fixed rules on standard AWS read-only APIs, across 30+ services and every region. Waste, idle, drift, RI/SP coverage, hygiene. The rules decide. Navi summarizes.

// new rules ship monthly
// full catalog →
Compute

Idle instances, endpoints, and over-provisioned Lambda.

EC2 · SageMaker · Lambda
Storage

Volumes nobody attached, old snapshots, gp2 still billed as gp2.

EBS · Snapshots
Database & cache

Stopped RDS, silent ElastiCache, DynamoDB tables with no traffic.

RDS · ElastiCache · DynamoDB
Networking

NAT with no traffic, unused load balancers, idle VPC endpoints.

NAT · ELB · VPC
Operations

Log groups that never expire, unused secrets, stale images.

CloudWatch · Secrets · ECR

Also: Graviton candidates, Cost Optimization Hub, extended support surcharges. See the full catalog →

// Delivery

Digest in your inbox.
Full web report and Navi in the app.

Email carries a concise weekly summary you can forward. The full web report (trends, drill-downs, executive rollups) and Navi live in the dashboard. Scan alerts: Slack or Teams. Leadership digest: email or a Telegram Channel.

Email
Email
weekly digest, every plan
Slack
Slack
scan alerts
Microsoft Teams
Teams
scan alerts
Telegram
Telegram
executive digest
#finops · Slack
un
unusd.cloud APP · 09:14
Weekly scan complete - $4,812/mo of waste detected across 6 accounts.
37 unattached EBS · $1,204/mo
14 idle EC2 · $968/mo
2 NAT gateways · $134/mo
platform-team · Teams
DRIFTseverity HIGH
acme-prod spending ↑ 38% above baseline
last 24h: $1,420 · expected $1,030 ± $80
likely driver
EC2 (eu-west-1) +$340 · CloudWatch +$50

Email is the weekly digest (see above). Slack and Teams carry scan alerts. Telegram is the leadership rollup, not per-account noise.

cost optimization reportscan #3f7a
Cost Optimization Report
acme · 6 accounts · 14 regions
EBS
unattached volumes
$1204/mo
EC2
idle instances
$968/mo
SM
idle endpoints
$480/mo
RDS
stopped > 7d
$312/mo

Sample of the in-app report. Same findings as the email, with drill-down.

// In the app

The full report lives here.

Trends, accounts, regions, and Navi on the same findings. Email is the summary you can forward.

SNS
enterprise
Findings as JSON for automation, ITSM, archive.
// Telegram Channel

Same digest. Built for a phone, and for people who do not live in AWS.

  • ▸Org rollup across accounts. No resource IDs.
  • ▸Posts to a channel you already run. Not a bot spam thread.
  • ▸Opens the full web report when someone needs the detail.
Acme FinOps
channel · @acme_finops
Telegram09:00
Executive report · Acme
12 accounts · $4,200/mo recoverable
mtd     $48.2K  +4.2%
eom     $72.4K
waste   $4.2K/mo  5.8%
score   72/100    Good
Forecast is stable. Recover idle compute and unused networking first; that is $2.1K/mo at low effort.
This week
1. Reclaim idle compute · Eng · $2.1K/mo
2. Convert gp2 volumes · Eng · $890/mo
Open full report
// navi · agent

An agent over your scans and web report.

Navi is the AI layer on top of your deterministic scans. Threaded chats and optional memory, with answers grounded in real findings and in-app report context, not the open web, not guesswork. Read-only. Nothing runs in AWS without you.

  • ▸Grounded in your scan findings and the in-app report, not the open web
  • ▸Your prompts are not used to train foundation models. Nothing runs in AWS without you.
Navi
acme · 8 connected accounts
online
Y
What's costing me the most this week and why?
N
Your top 3 cost drivers (week 16):
m5.4xlarge i-0a1b2…
$612
acme-prod / eu-west-1
3% CPU · idle 10d
40 unattached gp3
$498
acme-staging
last attached > 30d
2 NAT gateways
$134
acme-dev
< 1MB egress/day
Source: scan 3f7a · cited rules: ec2/idle-instance, ebs/unattached-volume, nat/low-throughput
Y
Draft a Slack message I can send to the staging owner
N
draft · for #platform
hey @amelie - heads up: 40 unattached gp3 volumes in acme-staging eu-west-1 are costing us ~$498/mo. last attached > 30 days. safe to delete?
details: app.unusd.cloud/scan/3f7a
Ask Navi about your AWS bill…
// Security

Boring on purpose.

hub-and-spoke
We never hold credentials. You deploy a role in your account, we sts:AssumeRole with a customer-unique ExternalId.
read-only
SecurityAudit + a small inline policy of standard, read-only AWS API calls. Inspectable in CloudFormation or Terraform before you deploy.
no data persistence
Report metadata only. We do not store your resource inventory. AES-256 at rest, TLS in transit.
no agents
No daemons in your VPC. Nothing to patch, nothing to break, no maintenance window.
unusd-spoke-role.ymlCloudFormation · excerpt
AssumeRolePolicyDocument:
  Statement:
    - Effect: Allow
      Principal:
        AWS: "arn:aws:iam::<unusd-hub>:role/scanner"
      Action: sts:AssumeRole
      Condition:
        StringEquals:
          sts:ExternalId: "<your-customer-id>"

ManagedPolicyArns:
  - arn:aws:iam::aws:policy/SecurityAudit

Policies:
  - PolicyName: unusd-cost-readonly
    PolicyDocument:
      Statement:
        - Effect: Allow
          Action:
            - ce:GetCostAndUsage
            - ce:GetCostForecast
            - cloudwatch:GetMetricData
            - cost-optimization-hub:ListRecommendations
            - pricing:GetProducts
          Resource: "*"
full template · CloudFormation, Terraform, StackSetsview docs →
// Pricing

Simple. Credit-based. Annual.

// 1 resource scanned = 1 credit
// billed annually · AWS Marketplace
Individual
$0/mo
credits/mo
on-demand
accounts
1
Navi
-
drift
-
notify
EmailEmail
Startup
$149/mo
credits/mo
15,000
accounts
unlimited
Navi
-
drift
●
notify
EmailSlackEmail · Slack
Businessmost teams
$500/mo
credits/mo
50,000
accounts
unlimited
Navi
Navi
drift
●
notify
EmailSlackMicrosoft TeamsEmail · Slack · Teams
Enterprise
$1,000/mo
credits/mo
100,000
accounts
unlimited
Navi
Navi+
drift
●
notify
EmailSlackMicrosoft TeamsSNSTelegramEmail · Slack · Teams · SNS · Telegram

1 credit = 1 resource scanned. Unlimited accounts from Startup. Navi on Business; Navi+ (custom) on Enterprise. Individual: 30 free scans, no credit card.

Need a private offer, NDA, or invoicing terms?Talk to us →
// FAQ

Answers for security, FinOps, and AI.

Quick facts for procurement, platform teams, and anyone evaluating read-only AWS cost tooling.

Is unusd.cloud read-only on AWS?+

Yes. We use standard AWS read-only APIs and a read-only IAM role you deploy. Nothing is changed in your accounts unless you act on findings yourself.

What AWS services and regions do you scan?+

We run deterministic rules across 30+ services and every enabled region (50+ detection types). The full catalog is documented at docs.unusd.cloud.

Can I scan more than one AWS account?+

Yes. Connect an Organization or as many accounts as you need. Individual is one account. Startup and above are unlimited accounts, billed by credits (resources scanned), not by account count.

How is Navi different from a generic chatbot?+

Navi is grounded in your scan results and in-app report context, not open-web search. It threads optional memory and Custom Instructions so answers stay relevant to your org.

Is my data or my prompts used to train foundation models?+

Your prompts are not used to train foundation models. See our product settings and docs for the latest privacy and retention details.

How does pricing work?+

One credit is one resource scanned. Plans are billed annually. Individual is $0: 30 free scans, no credit card, one account. Startup and above include unlimited accounts. AWS Marketplace billing is available for procurement.

What do I get in email vs the app?+

Email carries a concise weekly digest you can forward. Slack and Teams get scan alerts. The executive digest can also post to a Telegram Channel. The full web report, trends, drill-downs, and Navi live in the dashboard.

How fast can I get the first scan?+

Most teams connect a read-only role in about five minutes and get a first scan shortly after.

// get started

Connect an AWS account.
Digest in your inbox,
full report in the app.

Deploy a read-only role with one click. We run your first scan right away: digest by email, full web report and Navi when you open the dashboard.

Start free scan→AWS Marketplace
30 free scans · no credit card · 5-minute setup