Cloud cost · security · drift
AWS, Azure, Google Cloud & KubernetesPanoptes connects your AWS, Azure and Google Cloud accounts and shows what you are spending, what is exposed to the internet, and what drifted from Terraform — in one place, for teams too small to hire a FinOps analyst.
A prioritised “Needs attention” list, with every item linking to the screen that fixes it, plus when the data was last synced.
Built for
The Monday-morning questions
Spend is stored by provider, service and account, so a jump is traced to where it came from — a new service, a spike, or a forgotten environment. Anomalies are flagged against a baseline, and idle or oversized resources come with a monthly price tag.
Panoptes re-scans your accounts on a schedule for publicly accessible storage and security rules that leave SSH, RDP or database ports open to the world. Each finding says what is wrong and how to fix it, and re-opens itself if the problem returns.
Upload a Terraform state file and Panoptes compares it with what is actually running: resources nobody declared, resources that vanished, and settings that were changed by hand in a console.
What’s inside
One normalized data model underneath, so the same screen works for an EC2 instance, a Compute Engine VM and an Azure VM.
Idle VMs, orphaned volumes, oversized instances and untagged resources — each with the monthly saving attached, plus a forecast and an Excel report for whoever signs the bill.
Public buckets and world-open SSH, RDP and database ports, found, ranked and tracked until resolved.
Namespaces, deployments and pods across EKS, GKE and AKS — read pod logs right in the browser.
Catch console edits and unmanaged resources before they become outages.
Plain-English questions answered from your own synced data, with the arithmetic shown — for example, “Which region costs the most?”
Budget and security alerts go where your team already works, and reports go to whoever signs the bill.
How it connects
A dedicated IAM user, service account or app registration — scoped to look, not touch.
It is tested live, then encrypted with AES-256-GCM before it is stored.
Resources, storage, spend and findings are synced into one normalized view, and refreshed on a schedule.
That is the whole list to get started. Write actions like starting or stopping a VM are optional, role-gated and audit-logged — never required for visibility.
Security, in plain terms
TOTP 2FA for accounts, and as an extra gate on risky operations.
Owner, admin, member and viewer roles; viewers are read-only for everything that mutates.
Sensitive actions are recorded — who, what and when — and exportable.
Login rate limiting and account lockout, same-origin checks on every mutating route.
Session and membership checks scope supported data access. Automated tests do not replace full tenant-boundary and provider acceptance checks.
Outbound webhooks carry an HMAC signature so receivers can verify them.
Panoptes is in beta. It is not a compliance certification, a full CSPM or a SIEM, and we have not published third-party audit reports yet. Its security checks cover selected storage and network exposures — useful, but not every risk in your cloud.
Pricing
See everything you run, across clouds, in one inventory.
Find what to fix: waste, exposure and drift — with AI to ask about it.
No credit card. Moves to Free if you don’t subscribe.
For larger orgs with identity, retention and support requirements.
| Feature | Free | Pro | Enterprise |
|---|---|---|---|
| Multi-cloud inventory (AWS · Azure · GCP) | Included | Included | Included |
| Cloud accounts | 1 | Unlimited | Unlimited |
| Resources tracked | 100 | Unlimited | Unlimited |
| Cost analytics & anomaly detection | Not included | Included | Included |
| Savings recommendations | Not included | Included | Included |
| Security scanning | Not included | Included | Included |
| Terraform drift detection | Not included | Included | Included |
| Kubernetes visibility | Not included | Included | Included |
| AI Copilot | Not included | Included | Included |
| Slack alerts | Not included | Included | Included |
| Webhook alerts | Not included | Included | Included |
| Executive report & Excel export | Not included | Included | Included |
| Approval workflows | Not included | Included | Included |
| Team members | 1 | 25 | Unlimited |
| Audit log retention | 7 days | 90 days | 365 days |
| SSO / SAML | Not included | Not included | In development |
Billing is handled in the console. Prices in USD. Limits shown here come from the same plan configuration the console enforces.
Before you sign up
Something missing? Email panoptes.cloud@gmail.com — a person answers.
Use a dedicated credential with scoped reads for the supported compute, storage and security checks. Validate billing separately: GCP actual costs require a configured BigQuery billing export with dataset read and query-job permissions; Azure billing coverage depends on scope. The connection test does not prove every service permission. Follow the provider steps in our docs.
Provider writes need additional permissions. VM controls, saved auto-stop schedules and supported remediation or Kubernetes actions can change infrastructure when those permissions are granted. Role and optional TOTP checks vary by route; not every direct action requires approval. Validate the workflow in a sandbox first.
Cloud credentials are encrypted at rest with AES-256-GCM before they touch the database, and are excluded from every API response and from the data sent to the AI Copilot.
Your question and selected stored workspace context are sent to Groq. The context builder excludes credential fields and raw provider payloads, but includes labels and selected resource identifiers. Do not put secrets in questions or labels. Answers depend on source coverage and can be incomplete or wrong.
Upload local Terraform v4 JSON per cloud account and manually compare selected fields with a stored inventory snapshot. Remote backends and auto-reconciliation are not implemented. Compatible OpenTofu JSON may parse, but full compatibility is unverified. Confirm missing/changed results against the provider, especially for unsupported resource types.
Panoptes is being validated with early teams. Coverage is deliberately focused — VMs, storage, spend, selected network and bucket exposures, Terraform drift, Kubernetes — and some workflows still have known limits. We would rather tell you that now than after you sign up.
Deployment files and operator guidance exist. Contact us to scope a self-hosted evaluation; complete packaging, restore acceptance and any support or SLA terms need separate confirmation. Enterprise SAML/SCIM and custom roles remain in development.
Connect one account with scoped credentials, run a sync and verify a known resource. Setup time depends on your provider and permissions. The initial trial does not require a payment card.
