Updated 2026-09-27. The connector stack now creates a read-only IAM role, not an IAM user with an access key; the paragraph on connecting says so.
Updated 2026-09-20. The 2024 version of this post described Refine as something you install and deploy into your own AWS account, said the data it processes never leaves your AWS environment, and described features Refine does not have — pipeline checks that block deployments, comments on recommendations, and a customer result we have never published. None of that was true of the product, so the post has been rewritten to describe Refine as it is. The original date is kept; this note is the record of the change.
Refine turns your AWS bill into a short, ranked list of things to do about it: which resources cost more than they need to, which spend moved unexpectedly, and which security settings need attention. Here is how the pieces fit together.
A hosted service, connected read-only
Refine is a hosted service, run by HabileLabs on AWS. There is nothing to install or deploy. You connect an AWS account by launching a CloudFormation stack that creates a read-only IAM role only Refine's AWS account can assume, with an External ID unique to your connection: billing and security-audit read, plus read access to the bucket your cost export lands in. No access keys are created. Refine never writes to your account, and you can revoke its access at any time by deleting the role.
Where your data goes
To analyze your bill, Refine copies your cost and usage data into its own AWS environment and stores it there, encrypted in transit and at rest. It does not stay only inside your account, and the service's terms say so plainly: the Data Processing Agreement covers how it is handled, /sub-processors lists every service that touches it, and /security-trust states how long each kind of data is kept. You can delete it at any time.
One cost dashboard
The dashboard shows where the money goes — by service, account, region and time — with the top cost drivers called out and a forecast for the current month. A plain-English narrative report explains what changed and why it matters.
Recommendations ranked by dollars
From your Cost and Usage data, Refine surfaces right-sizing, idle-resource, storage-class and commitment-coverage opportunities, each with an estimated monthly saving so the biggest wins sit at the top. You accept, snooze or dismiss each one with a reason. The change itself is always yours to make, in your own account.
Anomaly alerts
Refine learns a baseline for each service and flags spend that breaks from it, with AI commentary on the likely cause. Alerts go to email, Slack or Microsoft Teams.
Security findings
Refine runs hundreds of security checks across IAM, storage, network, compute and logging, and ranks the findings by severity. Where a fix is well understood, the finding carries a "Fix Available" guide: the AWS Console steps for that resource, and the AWS documentation behind them.
Budgets, forecasts and allocation
Budgets track actual spend against a target and warn you before the month closes. Tag governance shows which spend is unallocated, and showback splits the bill by team or customer.
Try it on a bill first
If you are not ready to connect an account, the free bill analyzer takes a CSV, XLSX or PDF bill and returns a savings report with no signup.
Pricing
Refine has a free plan for smaller AWS bills and flat paid plans banded by monthly AWS spend. The current bands and prices are on the pricing page.
Conclusion
Refine does the reading: it ingests your AWS bill, ranks what to fix by what it is worth, and tells you when spend moves. What to change, and when, stays with you.