What's shipped

The connector stack now creates a read-only IAM role instead of an IAM user and access key. Refine’s AWS account assumes it for an hour at a time, and only with the External ID generated for your connection — a value only you and Refine hold, so no other Refine customer can point us at your role. There is no secret to retrieve, paste, rotate or leak: you give Refine the role’s ARN.

Already connected with an access key? It keeps working, encrypted as before. Move it to a role from Settings → Accounts — the stack runs in a role-only mode for an account that already exports its billing data — and the key is deleted from Refine.

If you use the free bill analyzer, your file used to be deleted the moment we finished reading it — typically within a minute. It is now kept for 3 days and then deleted automatically, by a storage lifecycle rule rather than by anyone remembering to run something.

Why the change. When you ask us to go through the analysis with you, the question is often about the bill itself — a line item, a tag, a region — and we no longer had it. The window means we can look at the same file you sent instead of asking you to send it again.

What has not changed. The file stays inside our AWS environment, encrypted in transit and at rest. Nothing renews the window, and nothing outside AWS ever receives the file. The analysis we generate from it is retained, as before.

Free used to be gated on account count: one standalone AWS account, and a management-account export did not fit. Spend did not come into it, which is why Free and Growth shared a band on the pricing page.

That rule was wrong in both directions. It gave the whole product away to a single-account company spending thousands a month, and it asked a two-account company spending a few hundred to pay. How you arranged your AWS estate is not a measure of what Refine is worth to you.

• Free — $0 forever, under $2k/month AWS spend
• Growth — $100/month flat, $2k–$10k/month
• Scale — $200/month flat, $10k–$50k/month
• Enterprise — custom above $50k/month

Nobody’s price went up. Every plan in force was set by hand or bought on AWS Marketplace, and neither is touched by this. The Free feature set is unchanged too, including its one connected account — that is a limit on what Free does, which is a different thing from the band that decides which plan you are in.

A locked control used to send you to the contact form — the same form a stranger fills in, reached by navigating away from whatever you were trying to do. Locked controls now open a request dialog in place. It records the plan you want, the plan you are on and which workspace you are asking for, and emails a human.

A request entitles nothing. It is a row in a queue: the moment after you submit it you have exactly the entitlements you had the moment before. We confirm the right fit when we reply, because the plan the published bands suggest is not always the plan that fits.

Growth, Scale and Enterprise stopped being announcements. Our team now assigns a plan and the entitlement gates honour it — so the capabilities the price table charges for are the capabilities the product hands out. Self-serve card checkout is still in build; until it ships, a short conversation is the whole path.

What is never gated, on any plan: the dashboard, cost analysis and the security summary. Ingest is never blocked and your data is never truncated — a free workspace sees less of the answer, not less of its bill.

The comparison marks which capabilities sit behind which plan, and which are still roadmap.

Refine now has published pricing: Free stays free forever for one AWS account, and three paid plans cover everything above it — flat prices banded by your prior month’s AWS spend, measured as the same BilledCost total your dashboard already shows.

• Free — $0, one account, up to $10k/month AWS spend
• Growth — $100/month flat, full product, up to $10k/month
• Scale — $200/month flat, $10k–$50k/month
• Enterprise — custom above $50k/month

Paid plans are launching soon — nothing changes for existing workspaces until self-serve checkout ships. The full comparison and the reasoning are on the pricing page and the announcement post.

Update, 2026-08-31: the paid plans went live that day — see the 2026.8.6 entry. What was “launching soon” was self-serve card checkout, and only that; the plans themselves are set up by our team and available today.

Update, 2026-09-06: the bands above are no longer current. Free is now gated on AWS spend — under $2k/month — rather than on connecting one account, and Growth starts there. See the 2026.9.1 entry.

Connecting an AWS account is now one click: a quick-create link opens the AWS console with a pre-filled stack that creates the FOCUS 1.2 data export, the receiving S3 bucket, and a read-only IAM user — with credentials sealed in AWS Secrets Manager, never printed in stack outputs.

• Two paths in the connect flow: Quick setup, or point Refine at an existing FOCUS export
• The template refuses to run outside us-east-1 instead of failing cryptically
• The export bucket is retained on stack deletion — billing history survives

Full walkthrough in the announcement post and the documentation.

Login-to-dashboard dropped from 12.5 seconds to under 4 on our largest workspaces, and first-load API requests fell from 146 to 28 — the app now loads what you’re looking at instead of everything you might ever look at.

• Anomaly counts, month-end projections, and savings totals now come from one shared engine each — the digest and the dashboard can no longer disagree
• Security screen redesigned: severity cards are one-tap filters, large accounts page smoothly
• The “data processing” banner stands down once the month’s report is actually ready
• Settings tabs live in the URL — bookmark or share a direct link

The measurements and the method are in the update post.

Split a month’s spend across teams and have it land in finance’s inbox on the 1st, with CSV and Excel attached. Untagged cost gets its own line rather than being spread across teams — you can see the tagging gap instead of quietly invoicing someone for it.

• Allocate by tag or service, with proportional, even, fixed-% or no shared-cost split
• An explicit “Unallocated” line, always shown
• Monthly email to chosen recipients, CSV + XLSX attached
• Every row links through to Cost Explorer, filtered to that team and month

Totals are reconciled against your billed spend for the period, and a report that does not tie out says so on its face rather than looking fine. Recipients are checked against account access when the mail is sent, not when the address was typed.

The month-end projection is now a forecast with a measured range, not a straight-line extrapolation. It learns your weekly rhythm and your month-end pattern, shows a P10–P90 range, and prints the error it actually achieves on your own history — so you can judge how much to trust it.

• P50 forecast with its P10–P90 range on the dashboard
• Backtested “typical error” shown alongside, measured per tenant
• Budgets: create your first budget from the forecast in one click, pre-filled at P80
• Under a month of history falls back to a run-rate and says so — no invented band

Accuracy is enforced in CI: the model must beat a naive run-rate on a seeded backtest suite or the build fails. Method and current numbers are written up in the forecast methodology doc.

Full marketing-site rebuild covering 38 routes — hero pages, product deep-dives, solutions personas, customer stories, compare pages, an honest /security-trust surface, and a rebuilt /documentation with 7-section IA. Built on a shared component set and a single brand-facts source of truth so claims can't drift.

• New /product/* pages: cost-optimization, security, anomaly-detection, tag-governance, forecasting, multi-account
• New /solutions/* persona pages × 5 (startups, enterprise, MSP, FinOps, engineering)
• New /roi-calculator with full per-lever breakdown
• New /customers index + 3 anonymized detail stories
• New /compare/aws-cost-explorer with honest comparison
• Rebuilt /documentation with 7-section sidebar IA + 23 topics

Anomalies now carry a plain-English AI-generated explanation alongside the statistical signal. Reduces alert-fatigue for on-call rotations by making the cause visible at a glance.

Org → Customer → Account hierarchy is live with strict data isolation between customers. Role-based notification routing sends cost alerts to FinOps, security findings to SecOps, and anomalies to on-call. See Multi-Account & MSP for the full architecture.

Security Score launched alongside the Optimization Score. 80 new findings added across IAM, network, and logging — catalog now at 380+ checks. Browse the catalog.

Findings where remediation is safe and well-known now carry a Fix Available badge that opens the AWS Console steps for that resource and region, plus a link to the official AWS documentation for the change.

Correction, 2026-09-04: this entry originally described a one-click Fix button behind a scoped opt-in policy. Neither shipped. Refine’s access to your account is read-only and it never applies a change — the badge means we hold a vetted remediation guide for that check. What it actually does.

New no-login flow: upload a bill to the free analyzer and get a savings report in 60 seconds. Uploaded files are deleted automatically 3 days after upload (amended 2026-09-19).

Untagged resource visibility ranked by spend, allocation gap trends, drift detection, and dry-run policy enforcement preview. See Tag Governance.