Your AWS bill should never surprise you again.
Theliv watches your cloud every night, catches waste and cost spikes the day they start, explains what changed, hands you the fix — and proves every dollar you save.
- Nightly
- every account, every service
- Read-only
- never touches your infra
- Verified
- savings proven, not estimated
Illustrative product view
- EC2
- EBS
- S3
- RDS
- Lambda
- CloudWatch
- NAT Gateway
- Elastic IP
- Fargate
- DynamoDB
The bill isn’t the problem. Finding out too late is.
A monthly review can’t protect you from a cost that started three weeks ago. Only something watching continuously can.
Without Theliv
- TuesdayAn engineer ships new infrastructure. Everyone moves on.
- That nightAn autoscaling rule is misconfigured. Forty instances stay up.
- Three weeksThe cost compounds quietly. Nothing is broken, so nobody looks.
- Billing dayThe invoice is $14,000 over. Three engineers stop building to explain it.
With Theliv
- Within a dayThe nightly run flags EC2 at 4.1× its usual daily cost — in Slack.
- Same alertThe likely cause in plain English, right next to the measured numbers.
- Ten minutesA copy-paste fix. Your engineer caps the group and clicks “I did this”.
- Billing dayNo surprise. The saving is on your verified ledger instead.
A loop that never stops running.
Not a one-time audit. The same five steps run the day you connect and every night after.
- 01DetectNightly cost ingest, per-account spike detection and a deterministic waste scanner.
- 02ExplainMeasured evidence first, then a plain-English likely cause, labelled as AI.
- 03Fixyour teamThe highest-impact fix, costed, with a Terraform or CLI snippet you run.
- 04VerifyThe next scan proves the resource changed — or a teammate attests “I did this”.
- 05SaveCredited once to Verified Dollars Saved — in the app and the monthly executive report.
- Account
- acme-prod
- Service
- EC2 – Other
- Today’s cost
- $298.00
- Increase
- +$155.82 (+109.6%)
Why this happened: Most consistent with NAT Gateway data processing from a new S3-heavy workload.
How to fix it: Add an S3 gateway endpoint to the VPC so S3 traffic stops flowing through the NAT Gateway.
Illustrative Slack alert — the cause and fix come from Claude Haiku and are labelled as AI in the app.
Built for the engineer who has to fix it — and the founder who signs the bill.
One worklist, ranked by money.
Waste and spikes in a single list, ordered by monthly impact × confidence. Every row carries the problem, the evidence, the fix and the dollar amount.
- Idle EC2, unattached EBS, orphaned Elastic IPs, gp2 → gp3
- Priced from published AWS list prices — no guesswork
- Keyboard-first: J/K to move, Ctrl/⌘ K to jump anywhere
- SpikeEC2 – Other up 2.1× since Sep 19$3,900
- Idle EC2m5.2xlarge idle for 14 days$280.32
- Idle EC2t3.xlarge idle for 14 days$121.47
- gp2 → gp314 volumes can move to gp3$65.54
- Unattached EBS500 GiB gp2 unattached 41 days$50.00
Illustrative · spike impact is the AI estimate (dashed); waste is priced by the detector
AI explains. You decide.
Every alert leads with what was measured, then a clearly labelled likely cause, the fix as code, and its estimated savings, risk and effort. Nothing in a box marked AI is ever presented as fact.
- Thresholds tuned to each account’s own variance
- AI estimates are drawn dashed — never mistaken for measured cost
- If the model is down, the measured alert still ships
Most consistent with NAT Gateway data processing from a new S3-heavy workload.
resource "aws_vpc_endpoint" "s3" {
vpc_id = var.vpc_id
service_name = "com.amazonaws.us-east-1.s3"
vpc_endpoint_type = "Gateway"
}Illustrative alert · shaded band = this account’s normal range (mean ± 2σ)
See the overrun before the invoice.
A run-rate forecast against each account’s budget, pushed to Slack while there’s still time to act. The Savings Center shows which open fix changes the outcome.
- Per-account budgets
- Projected breach date, not just a total
- Slack alert before the month ends
- Spend MTD
- $25,375
- Forecast
- $36,250
- Budget
- $35,000
Illustrative · run-rate forecast = month-to-date spend ÷ complete days × days in month
We don’t estimate savings. We prove them.
A dollar only counts once the wasteful resource is provably gone from a later scan — or someone on your team clicks “I did this”. It’s a number you can hand your CFO without a caveat.
- Detected by the nightly scan
- Your team makes the change
- Next scan proves it → credited, once, forever
- Idle m5.2xlarge stoppedi-0a7f…5f60 · absent in next scan$280.32
- Unattached 1,000 GiB gp2 deletedvol-09a4…5a86 · absent in next scan$100.00
- 500 GiB moved gp2 → gp3vol-04c2…7e62 · type = gp3$10.00
- Elastic IP releasedeipalloc-0f3e…9788 · released$3.65
Cost Explorer shows you the bill. Theliv shrinks it.
Tells you what changed
- Cost Explorer
- Yes
- Theliv
- Yes
Tells you why it changed
- Cost Explorer
- —
- Theliv
- Likely cause on every spike, beside the measured evidence
Tells you exactly what to fix
- Cost Explorer
- —
- Theliv
- Fix + copy-paste Terraform / CLI
Warns you before billing day
- Cost Explorer
- —
- Theliv
- Nightly detection + budget forecast in Slack
Finds waste automatically
- Cost Explorer
- —
- Theliv
- Deterministic waste scanner
Proves the saving landed
- Cost Explorer
- —
- Theliv
- Verified Dollars Saved ledger
Lives where engineers work
- Cost Explorer
- Console only
- Theliv
- Slack, the app, and a monthly email report
Built to be the safest thing you connect to AWS.
Theliv observes, explains and recommends. You run every change — and you can disconnect in one click.
- Read-only, alwaysDescribe/read and billing scopes. No mutation, by design.
- No stored keysRuntime STS AssumeRole with a unique external ID.
- Encrypted secretsSlack webhook URLs are AES-256 encrypted at rest.
- Tenant isolationEvery query scoped to your organization, with role-based access.
The reviewer’s checklist
- Read-only cross-account IAM role, one CloudFormation template
- Least privilege: Cost Explorer + budgets read, EC2 describe (volumes, addresses, instances), CloudWatch metrics read
- Zero write access — no infrastructure changes, ever
- Unique external ID per account (confused-deputy safe)
- No application data, logs or workload contents — cost and resource metadata only
- Disconnect anytime — you keep full ownership of your AWS account
- SSO, SCIM and immutable audit logsRoadmap
The onboarding wizard shows every permission in the template before you deploy it.
First findings in about six minutes.
No agent, no code changes, no integration project. One read-only role and you’re watching.
- 0:00Create accountEmail, Google or GitHub.
- ~1:30Connect AWSLaunch one CloudFormation stack.
- ~4:00Role verified30 days of cost history load in.
- ~6:00First findingsEach with a dollar figure and a fix.
- ~8:00Slack connectedAlerts where you already work.
- Week 1First verified dollarProven by a later nightly scan.
Typical timings. CloudFormation and the first scan take a minute or two each; larger estates take longer.
Priced to be a rounding error on the waste it finds.
Questions a careful engineer asks first.
Can Theliv modify my AWS account?
Never. Theliv is read-only by design and by promise. It recommends fixes and hands you a copy-paste artifact, but you run the change. Nothing we generate mutates your AWS account automatically — even on the roadmap, any remediation stays explicitly customer-approved.
What permissions does Theliv require?
A read-only cross-account IAM role, deployed with one CloudFormation template. It grants Cost Explorer and budgets read access, EC2 describe calls for regions, volumes, Elastic IPs and instances, and CloudWatch metrics read. No write permissions of any kind — the onboarding wizard lists every action before you deploy it.
How do you verify a saving?
A finding only becomes a Verified Dollar Saved when the wasteful resource is provably gone (or changed) in a later scan, or someone on your team clicks “I did this”. Each saving is credited once — the database prevents double-counting — and we would rather under-count than inflate. That’s the ledger you can show finance.
What happens if the AI is wrong?
The AI only narrates. Every resource fact and waste figure comes from deterministic detectors and AWS list prices, not the model. On spike alerts, the AI’s likely cause and savings estimate are labelled as AI and drawn dashed, so they’re never mistaken for measured cost. If the model is unavailable or returns bad output, the measured alert still ships.
How is this different from Cost Explorer or other FinOps tools?
Cost Explorer tells you what your bill was — after the fact, in the console, with no cause and no next step. Most FinOps platforms are allocation and reporting dashboards for finance. Theliv is built for the engineer who has to act: nightly spike detection, a plain-English likely cause, a copy-paste fix in Slack, and a ledger that proves the saving landed.
What if you don’t find enough to justify the cost?
Then you’ll know within days and can cancel — no lock-in. Theliv is priced to be a rounding error against the waste it finds. If it isn’t finding waste worth more than the subscription, it isn’t doing its job.
Show all 15 questions
Is it safe to connect my AWS account?
Theliv never stores long-term AWS credentials — it assumes the read-only role at runtime via STS, and every request carries a unique external ID to prevent confused-deputy access. Slack webhook URLs are AES-256 encrypted at rest, every query is scoped to your organization, and row-level security is enabled on every table.
How long does onboarding take?
Usually under ten minutes. Launch one CloudFormation stack, paste the role ARN, and Theliv verifies the role, loads 30 days of cost history and runs its first waste scan in the same session. No integration project, no professional services.
Can I disconnect anytime?
Yes — disconnect the account in Theliv, and delete the IAM role on your side whenever you like. You keep full ownership of your AWS account the whole time; Theliv only ever had read access.
How often do you scan?
Every night automatically, plus on demand whenever you click “Sync now”. The nightly run fetches costs, detects spikes per account, scans for waste, reconciles earlier findings and checks your budget forecast.
How much engineering effort does this take?
Roughly zero after setup. There’s nothing to instrument, no agent to install and no code to change. Read-only means there’s nothing risky to approve, and alerts arrive in Slack.
How much of my data do you store?
Only the cost and resource metadata needed to detect waste and spikes — daily cost per service and the identifiers of resources that look wasteful. No application data, no logs, no data from your workloads.
Will this slow down my AWS account?
No. Theliv reads from Cost Explorer and the describe/metrics APIs on its own schedule — it never sits in the path of your workloads and adds no load to your running infrastructure.
Can I connect multiple AWS accounts?
Yes. Growth supports up to three accounts and Pro is unlimited. Each account gets its own read-only role and its own spike sensitivity, alert floor and budget.
Do you support Azure or GCP?
Not yet — Theliv is AWS-only today. Azure, GCP and Kubernetes coverage are on the roadmap.
Give your team back the bill.
Your engineers should be building product, not explaining cloud invoices. Theliv watches every night and proves every dollar.
About six minutes to your first findings · read-only · disconnect anytime