Disclaimer

Kostrix examines the data your AWS accounts expose to it and produces findings: observations that a resource looks idle, over-provisioned, unattached, untagged, duplicated, wrongly sized, or purchasable on cheaper terms. Each finding is a suggestion for you to evaluate. It is not an instruction, a certification, or a professional opinion.

We do not know your business. We cannot see why a volume is kept, why an instance is idle this week, what a workload does at quarter end, what your disaster-recovery posture requires, what a contract or a regulator obliges you to retain, or what a colleague intends to deploy tomorrow. A resource that looks like waste to an analysis of metrics may be load-bearing for reasons that never appear in metrics.

You must independently verify every finding against your own knowledge of your environment before you act on it. The service is designed to help a competent engineer decide faster; it is not designed to replace that engineer's judgement, and it must not be used as though it were.

Do not configure any automation, script, pipeline or policy to act on our output without a human review step. If you choose to do so despite this, you do so entirely at your own risk and on your own responsibility.

Every monetary figure the service shows you — a monthly saving, an annual projection, a forecast, a total for a group of findings, a percentage — is a modelled estimate. It is calculated from the data available to us, using assumptions, on prices and usage patterns that change.

Estimates can be wrong, and are wrong in both directions, for reasons that include:

• AWS price changes, regional price differences, and pricing terms specific to your agreement with AWS that we cannot see;
• private pricing, Enterprise Discount Programme terms, credits, promotional credits, support charges, tax and currency effects;
• existing Reserved Instances, Savings Plans or commitments that shift the true marginal cost of a resource;
• billing data that AWS makes available late, restates, or reports at a granularity that does not resolve to a single resource;
• usage that changes between the moment we measured it and the moment you act;
• resources, accounts, regions or services that are outside the access you granted us, or that our coverage does not yet extend to;
• second-order effects of a change — on performance, on another team's workload, on data-transfer charges, on an unrelated bill line.

Savings shown as "realised", "achieved", "captured" or similar are our reconstruction of what changed, not an audited figure. They are not a substitute for your AWS bill, your Cost and Usage Report, or your finance function's own accounting.

WE DO NOT GUARANTEE ANY SAVING. We do not guarantee that a saving will occur, that it will be of the size estimated, that it will persist, or that it will exceed what you pay us. Nothing on our website, in the product, in a report, in a proposal or in any conversation is a promise, warranty or representation of a financial outcome, and you must not rely on one as though it were.

Your AWS account is your property, under your control, governed by your agreement with Amazon Web Services. We are not a party to that agreement, we are not an agent or reseller of AWS, and we are not affiliated with, endorsed by or sponsored by Amazon Web Services, Inc. or any Amazon company. "Amazon Web Services" and "AWS" are trademarks of their owner and are used here only to identify the platform the service reads.

Every change made in your AWS environment is made by you or by someone acting for you. We do not stop an instance, delete a volume, release an address, resize a database, modify a policy, purchase a commitment or alter a configuration. If a change causes an outage, data loss, degraded performance, a failed audit, a breach of an internal or customer-facing commitment, or an unexpected increase in cost, that consequence is yours, whether or not the change followed one of our findings.

Before acting on any finding, we expect you to satisfy yourself — in your own environment, using your own change-management, backup, testing and rollback procedures — that the change is safe. Take a snapshot. Check who owns the resource. Check the dependency. Do it in a non-production account first. These are your controls, not ours.

You are responsible for ensuring that you are entitled to connect each AWS account you connect, and that doing so does not breach any obligation you owe to an employer, a client, a joint-venture partner or anyone else.

The service requests read-only permissions in your AWS account and is built not to call any API that changes the state of a resource. The IAM policy is published in full and you can read it before you grant anything. You can revoke the access at any time from your own AWS console, without our involvement.

Read-only is a meaningful safeguard, and it is the reason a mistake in our software cannot delete your infrastructure. But it is not a guarantee of harmlessness, and we will not pretend otherwise. Read operations consume API quota and can be rate-limited; a broad read of a very large estate consumes CloudWatch, Cost Explorer or API calls that AWS may charge for; and read access necessarily means we can see configuration and metadata about your environment, which is information of value to an attacker who obtained it.

Granting access is a decision with consequences. Review the policy, grant the narrowest scope that lets the service work, use a dedicated role, and revoke it when you stop using the service.

Reading your account is not free of charge. AWS bills some of the API calls the service makes to your AWS account - chiefly AWS Cost Explorer requests, at the date of this version US$0.01 each. A scan typically makes a few dozen such requests; at the default of one scan a day that is in the order of US$15-40 a month for each connected AWS account, and more for a large estate, a shorter scan interval or manual scans. These are AWS's charges to you, not ours: they are not included in the fees for the service, we do not guarantee any figure for them, and we are not responsible for them (Terms of Service, clause 4).

The service covers a set of AWS services, regions, resource types and optimisation patterns that grows over time and that is, at any moment, incomplete. Some services are not analysed at all. Some are analysed only for certain patterns. Some regions may not be scanned. A scan may fail, be throttled, be partially blocked by your own permissions or service control policies, or run against data AWS had not yet published.

It follows that ABSENCE OF A FINDING IS NOT EVIDENCE OF ABSENCE OF WASTE. A clean dashboard means that we found nothing in what we looked at, not that there is nothing to find. Equally, a figure described as your total spend, or as covered spend, reflects what the service was able to read and reconcile, and may not agree with your AWS invoice.

Where we know a scan was incomplete we try to tell you so. We do not warrant that we always detect or always report incompleteness.

We take the security of your data seriously and we invest in it. As at the date of this Disclaimer the service encrypts data in transit using industry-standard transport security; encrypts data at rest; encrypts stored AWS credentials under a key held separately from the data they protect; stores passwords only as slow, salted hashes; requires multi-factor authentication for administrative access; isolates its network; limits and locks out repeated authentication attempts; keeps audit logs; requests only least-privilege read-only access to your AWS account; and publishes the IAM policy it runs under so that you can check it against what it claims.

We keep our dependencies patched, we review changes before they ship, and we treat a reported vulnerability as a priority.

And yet: NO SOFTWARE IS FREE OF DEFECTS, AND NO SYSTEM CONNECTED TO A NETWORK CAN BE GUARANTEED SECURE. Bugs exist in our code and in every library, operating system, protocol and cloud service beneath it. New classes of vulnerability are discovered in software that was believed sound for years. Cryptography that is strong today is weakened by tomorrow's research. Encryption protects data at rest and in transit; it does not protect data at the moment it is legitimately decrypted so that the service can use it. A sufficiently determined, well-resourced or simply novel attack may defeat controls that were entirely reasonable when they were chosen. A supplier we depend on may be compromised without our knowledge.

So we tell you plainly: WE CANNOT AND DO NOT WARRANT THAT THE SERVICE WILL NOT BE COMPROMISED, that a defect or vulnerability will be found before someone exploits it, or that data held in the service cannot be exposed, altered or lost as a result. You should take that residual risk into account when you decide what to connect and what to store, exactly as you would for any other networked service.

What we do promise is honesty about it. If a breach affecting your data occurs, we will investigate, we will contain it, and we will tell you what happened, what we know, what we do not yet know, what the likely consequences are and what we are doing — and we will notify you and the competent authority within the time and in the manner the law requires. Nothing in this Disclaimer limits or excludes any obligation or liability we have under the Digital Personal Data Protection Act, 2023, sections 43A and 72A of the Information Technology Act, 2000, or any other law that may not be limited or excluded by agreement. This clause is a statement of risk, not a waiver of your rights.

Security is shared. Use a strong and unique password, turn on multi-factor authentication, protect the mailbox that receives your account e-mail, review who in your organisation has access, and revoke what is no longer needed. We cannot protect your account from a credential you have given away.

Kostrix is offered as a beta service. It is under active development. Features may be added, changed, restricted or withdrawn; interfaces may change; and analyses may be revised, which can cause a finding to appear, disappear or change in value between one scan and the next without anything having changed in your AWS account.

We do not commit to any level of availability, any maintenance window, any support response time or any data retention period unless we have agreed one with you in a separate signed writing. The service may be unavailable for maintenance, for reasons outside our control, or because of a fault.

Keep your own records of anything you need to keep. Do not treat the service as a system of record, an archive, or a backup of your AWS data.

The service depends on third parties — among them Amazon Web Services, our hosting and infrastructure providers, our payment processor, our e-mail delivery provider and the maintainers of the open-source software we use. Their availability, correctness, security and pricing are outside our control, and a failure in any of them can affect the service or the accuracy of what it shows you.

Links, references and documentation pointers to third-party material are provided for convenience. We do not control that material, we do not endorse it, and we are not responsible for its accuracy or for what happens if you follow it.

Where the service is obtained through a marketplace or a reseller, that provider's own terms govern the ordering, billing and metering relationship, and this Disclaimer continues to govern the service itself.

Nothing the service produces, and nothing on our website or in our documentation, marketing or correspondence, is financial advice, investment advice, tax advice, accounting advice, legal advice, audit assurance, or a security assessment or certification.

Findings about commitments — Reserved Instances, Savings Plans and similar — concern a financial commitment with a term, and buying one is a financial decision with consequences that may outlast the workload that justified it. Take advice appropriate to your circumstances before you make one.

Output from the service is not an audit, is not prepared to any assurance standard, and must not be presented to a regulator, auditor, investor or customer as though it were.

Any output of the service that was generated with the assistance of automated reasoning or machine-learning models may contain errors, including confident-sounding errors, and is subject to everything said in clauses 1 and 2 above.

This Disclaimer is incorporated into, and forms part of, the Kostrix Terms of Service. Accepting the Terms means accepting this Disclaimer.

Your remedies, and the limits on our liability, are set out in the Terms — in particular clause 12 (Warranties and disclaimers), clause 13 (Limitation of liability), which caps our aggregate liability and lists the categories of liability that are not capped and cannot be excluded, clause 19 (Governing law, disputes and jurisdiction), under which disputes are resolved individually by arbitration, with no class actions and no jury, clause 23 (Use outside India, local law and mandatory rights), which keeps your mandatory local rights, clause 27 (Release and assumption of risk) and clause 32 (Exclusive remedies). This page summarises the risk; the Terms allocate it.

Where this Disclaimer and the Terms are capable of being read differently, the Terms prevail.

Neither document excludes, restricts or modifies any right or remedy that applicable law gives you and that may not lawfully be excluded, restricted or modified. If a court finds any part of this Disclaimer unenforceable, that part is severed or read down to the minimum extent necessary and the rest continues to apply.

If anything on this page is unclear, or you believe a finding is wrong, or you want to report a security issue, write to us at support@kostrix.com before you rely on or act against the output in question. We would much rather answer a question than have you act on a figure you did not trust.

To report a suspected vulnerability, write to support@kostrix.com with the detail you can share. We will acknowledge it and we will not pursue anyone who reports a genuine issue to us in good faith and without exploiting it beyond what was necessary to demonstrate it.

Grievances may be addressed to Vibhor Agarwal, Grievance Officer at contactus@whizzygeeks.com. Questions about personal data may be addressed to the Data Protection Contact at contactus@whizzygeeks.com; how we handle it is set out in the Privacy Policy at https://www.kostrix.com/privacy.

Whizzy Geeks Internet Services Private Limited, GH-4/32, Meera Bagh Apartment, Block GH-4, SFS Flats, Paschim Vihar, West Delhi, Delhi 110063, India.

Nothing the service produces tells you that you comply with any law, regulation, standard, framework or contract, in India or in any other country - including tax, accounting, data-protection, data-residency, financial-services, public-procurement or cloud-security rules and frameworks such as SOC 2, ISO/IEC 27001, PCI DSS, HIPAA, GDPR or the AWS Well-Architected Framework. A finding that mentions one of them is a pointer for your own specialists, not an assessment.

Tax and accounting treatment of cloud spend, of commitments and of savings differs between countries. Do not book, report or forecast a figure from the service without your own finance function's review.

Kostrix is operated from India under the laws of India. If you use it from anywhere else, you do so on your own initiative and are responsible for complying with local law. The Terms of Service explain, in clause 19 (Governing law, disputes and jurisdiction), how disputes are resolved - individually, by arbitration in India - and, in clause 23 (Use outside India, local law and mandatory rights), which of your local rights no contract can take away.

Where a statement on this page could not lawfully be made in your jurisdiction, it applies to the greatest extent the local law allows, and the rest of this page continues to apply.

Fees are not refundable except where the law requires it or we agree to it in writing (Terms clause 6). Where a refund or reimbursement is made, the money that comes back to you is what we are able to recover: the payment processor's fees, any foreign-currency markup or conversion difference, cross-border and bank charges, and tax already remitted that cannot be adjusted are deducted first. How much those come to depends on how you paid, in which currency, through which bank and from which country, so it differs from case to case and cannot be stated in advance.

Subject to the rights the law gives you and does not let us exclude (Terms clause 23, Use outside India, local law and mandatory rights), the decision whether a refund is made, and its final amount, is ours. We will tell you how the amount was arrived at. Nothing in this clause takes away a refund the law requires us to make.