Self-hosted Runs in your AWS account

Cut your cloud bill without handing anyone your keys.

CloudPilot inventories what you run, prices it, finds the waste, and either recommends a fix or applies an approved one with a rollback path. At month end it reports what you actually saved — measured against your bill, not against its own estimates.

See pricing Deploy it yourself
✓ Free tier, no licence key · ✓ Nothing leaves your VPC · ✓ Read-only until you say otherwise
✓ 63 findings, evidence attached
↓ Realized from your actual bill
19
Detection rules — idle compute, rightsizing, orphaned storage, oversized node pools, recurring incidents, untagged spend.
17
Remediations, each with an approval gate, captured pre-state and — where physics allows — one-click rollback.
25%
Of inventoried spend typically flagged as waste on a first scan. Every finding ships with the metrics behind it.
0
Credentials shared. It runs on your EC2 or your cluster; your billing data never leaves your account.
What it does

Four jobs, in the order a team actually needs them.

See the bill, attribute it, find the waste, then fix it without breaking anything.

See the whole bill

Multi-account cost visibility from Cost Explorer, joined to a live inventory of EC2, EBS, RDS, S3, load balancers, NAT gateways, elastic IPs and EKS. Spend you cannot attribute is called out rather than buried.

Charge Kubernetes back to the team that caused it

Node cost splits across pods by their share of allocatable capacity, on max(request, usage). A pod reserving four cores and burning one blocks the scheduler, so the team that set the request owns the cost. What no pod claims is reported as idle capacity.

Find waste you can defend in a review

Every finding ships with the metrics that produced it, a confidence level and a risk level. An instance with under 48 hours of CloudWatch history is never called idle. A downsize that would push p95 CPU past 70% is never recommended.

Fix it, reversibly

Dry run is on by default. Nothing changes until a named person approves it. Volumes are snapshotted before deletion; workloads record their original resource block before being patched. All of it lands in an audit log.

How it runs

From launched to first finding in about ten minutes.

1

Create a read-only role

Attach the read-only policy and CloudPilot physically cannot change anything. You lose nothing but the ability to press Execute.

2

Run it next to your infrastructure

Docker Compose on a t3.small, a systemd unit, or Helm into the cluster it is costing. All three reach the same dashboard.

3

Scan and read

Findings arrive with their evidence. Dismiss what does not apply; dismissals stick across scans.

4

Turn dry run off when you are ready

Start with gp2→gp3: online, reversible, and roughly 20% off every gp2 volume you own.

Four gates before anything changes

Dry run by default, human approval per action, accounts you mark read-only are never touched, and anything irreversible stays behind a separate flag you have to set deliberately.

What leaves your network

A licence check carrying aggregate counts — accounts, clusters, open findings, total identified saving. No resource ids, no account ids, no per-service cost. That is the whole list.

Savings you can put in a board pack

Most tools report what they think they saved.

CloudPilot reports what your bill actually did.

Forecast

From the pricing model

Shown on every finding, useful for prioritising, and labelled an estimate wherever it appears. Reserved Instances and Savings Plans are not modelled, so forecasts for covered resources overstate the benefit — the docs say so rather than hiding it.

Realized — from your bill

Measured, not claimed

For each executed action, the affected Cost Explorer service's average daily spend over the 14 days before is compared with the 14 days after, scaled to a month. Both daily rates ship with the number. Dry runs count as zero.

Where that number is honest, and where it is not. It is attribution, not isolation — an unrelated change to the same service lands inside the same delta. The report says so every time, and shows you exactly which windows it compared.

Start on the free tier. No key, no card.

Cost visibility for one AWS account, with all 19 detection rules. Add a licence when you want multi-account, Kubernetes allocation and automated remediation.

Deployment guide Compare plans