Frequently Asked Questions

plainfra gives businesses operational clarity over AWS. It connects through a read-only IAM role, answers plain-English questions, and sends weekly health reports covering security, cost, and reliability. The role can inspect infrastructure metadata, but it cannot change infrastructure or read application data.

During signup, you deploy a CloudFormation template in your AWS account. This creates the plainfra-ReadOnly IAM role that plainfra uses to query infrastructure metadata. You can inspect the YAML before deploying. No CLI tools, agents, or shared AWS credentials are required.

The IAM role is global and covers all AWS regions, so you do not deploy anything per region. On the Scout plan, plainfra works in a single region at a time (3 tool calls per question). On the Core plan, plainfra covers multiple regions in a single report and chat session. On Team and Enterprise plans, plainfra covers multiple regions across multiple AWS accounts (up to 5 on Team, up to 10 on Enterprise).

Yes, on the Team plan (up to 5 accounts) and Enterprise plan (up to 10 accounts). Each account gets its own CloudFormation stack and IAM role. Weekly reports can cover all connected accounts in a single combined report.

For self-serve signup, yes. plainfra deploys the read-only role into each member account via CloudFormation from your AWS Organizations management account. That is the cleanest way to reach many accounts from one place without asking each account owner individually.

If you have a different setup (for example, IAM Identity Center access scoped to specific accounts, or an existing cross-account role pattern), contact support and we'll help you onboard manually.

plainfra can inspect infrastructure metadata and service configuration: security groups, route tables, load balancers, Cost Explorer data, CloudWatch alarms, backup settings, IAM metadata, and S3 bucket configuration. It cannot read S3 object contents, database rows, DynamoDB items, Secrets Manager secret values, secure SSM parameters, queue messages, or log event contents.

No. The IAM role is read-only and cannot create, update, or delete resources. It also includes an explicit deny policy that blocks access to data contents such as S3 objects, DynamoDB records, log events, and Secrets Manager secret values. See our Security page for the full list of denied actions.

Customer account records, conversation history, generated reports, and infrastructure metadata are stored on AWS infrastructure in Sydney (ap-southeast-2). Conversation history is retained for 90 days and reports for 365 days, both encrypted at rest. Your infrastructure data and queries are never used to train AI models.

Delete the plainfra-ReadOnly CloudFormation stack from your AWS Console. Access is revoked immediately. Your account record and conversation history in plainfra can be deleted on request.

No. Your infrastructure data, queries, and responses are never used to train AI models. plainfra may retain conversation history and query logs for service operation, debugging, and support under the retention periods in the Privacy Policy.

The trial gives you 50,000 tokens over 48 hours with 1 AWS account connection. This lets you prove the connection works and explore your infrastructure before committing to a plan.

Your trial access stops and you will not be charged unless you explicitly choose a paid plan. Your account configuration and conversation history are retained under the Privacy Policy so you can upgrade later. You can delete the CloudFormation stack at any time to revoke AWS access.

Tokens measure the AI processing used in your conversations and reports. A typical chat session uses 10,000-30,000 tokens. Your token allowance covers both input (your questions plus AWS API response data) and output (the AI's analysis). If you run out, you can purchase a one-time top-up of 1 million tokens for $25. Top-ups never expire.

• Scout: $20/month. 2M tokens, 1 AWS account, single region, lite AI model.
• Core: $79/month. 2M tokens, 1 AWS account, weekly health report, multi-region.
• Team: $179/month. 5M tokens, up to 5 AWS accounts, combined weekly report.
• Enterprise: $480/month. 20 people included, 10M tokens, SSO, additional seats at $29/month, up to 10 AWS accounts, 365-day session history.

See the Pricing page for full details.

Anything about your AWS infrastructure in plain English. Common examples: "What security groups have unrestricted access?", "Why did my AWS bill spike last month?", "Show me all Lambda functions that haven't been invoked in 30 days", "Are there any unencrypted S3 buckets?". plainfra makes the AWS API calls and analyses the results for you.

Automated PDF reports delivered weekly with RED/AMBER/GREEN indicators across security, cost, and infrastructure health. Each finding includes specific resource details and actionable recommendations. You can deep-dive into any finding directly from the report via Report-to-Chat.

AWS is the primary integration, connected via the CloudFormation IAM role. plainfra also supports Datadog, Slack, and Sumo Logic for ecosystem visibility. Jira and GitHub issue creation from findings is on the roadmap.

Your API key is shown once during signup and in the welcome email. We store only the SHA-256 hash, so we can't recover the original. Contact support@plainfra.com and we'll issue a new key.

Email support@plainfra.com and we'll cancel your subscription immediately. You can also delete the CloudFormation stack from your AWS Console to revoke access at any time, independently of your billing status.