# Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation This site has an agentic ask interface you may use to query the documentation dynamically by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://docs.quper.co/index.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. --- # Quper Documentation Everything you need to connect, understand, and optimise with Quper :) *** Welcome to the Quper documentation hub. Quper is a cloud intelligence platform that gives data and engineering teams full visibility into cloud and warehouse spend. It monitors costs, detects anomalies, and surfaces AI-powered recommendations so your team can stop overpaying and start acting with precision. ## Where to start
Cover image
🚀Getting startedConnect your cloud and set up your account in minutes.Quickstarthttps://i.pinimg.com/736x/d9/81/5c/d9815c4d80797859977022c42c0f5cad.jpg
🔌IntegrationsConnect AWS, GCP, Azure, Snowflake, Databricks, and BigQuery.Overviewhttps://i.pinimg.com/736x/e5/3e/fe/e53efe20f752307ac06eb9c1a3fbf81d.jpg
📖User GuideObserve spend, detect anomalies, take action, and govern costs.Spend Overview
🤖Vidura AIQuper's AI engine for root cause analysis and cost optimisation.Vidura AI Overview
# Introduction Quper is a cloud intelligence platform that helps you understand what's happening across your cost, usage, allocation, and performance — and tells you what to do about it. ## The problem Quper solves Modern engineering teams run workloads across multiple cloud providers and data platforms simultaneously. Costs accumulate across AWS, GCP, Azure, Snowflake, and Databricks — often without any single team having a clear picture of what is driving spend or how to reduce it. Existing tools show dashboards and fire alerts. Quper goes further: it explains the root cause of every cost event and surfaces ranked, actionable recommendations so your team can act immediately — not days later. ## How Quper works Quper connects to your cloud providers and data warehouses using secure, read-only access. Its proprietary ingestion layer maps real-time infrastructure metrics to FinOps outcomes, creating a unified semantic model of your cloud environment. From there, Quper organises everything into four intelligent steps: ### Observe Get a complete breakdown of every dollar spent across your cloud — by service, team, workload, and region. Quper provides granular cost attribution with daily and hourly resolution, giving you a unified view you can't get from any single provider's native billing console. ### Detect Quper detects abnormal cost patterns the moment they emerge using ML-powered anomaly detection. Every alert comes with full context: which workload is responsible, what changed, and what it is costing per hour. You get insight before your bill arrives. ### Decide Stop staring at charts and start acting. Quper surfaces prioritised recommendations tied directly to impact — rightsizing, idle resource termination, warehouse auto-stop configurations — so your team knows exactly what to fix and in what order. ### Govern Set the rules. Quper enforces them. Establish team budgets, tag policies, and spend guardrails that prevent ungoverned cloud growth before it compounds into uncontrolled cost. Governance reports are exportable for finance and executive reviews. ## Supported platforms Quper integrates with all major cloud providers and data platforms: | Platform | Type | | ------------------ | -------------- | | AWS | Cloud Provider | | Google Cloud (GCP) | Cloud Provider | | Microsoft Azure | Cloud Provider | | Snowflake | Data Warehouse | | Databricks | Data Platform | | BigQuery | Data Warehouse | ## Powered by Vidura AI Vidura is Quper's built-in AI engine. It monitors hundreds of signals across your infrastructure in real time, performs root cause analysis on anomalies, and generates cost optimisation recommendations ranked by savings potential. Every action Quper surfaces comes from Vidura's analysis. ## Next steps * [Quickstart](/get-started-with-quper/quickstart) — Connect your first cloud provider and see spend data within minutes * [Onboarding Your Team](/get-started-with-quper/onboarding) — Invite users and configure role-based access * [Integrations](/integrations/integrations) — Browse all supported platforms and connection guides # Quickstart Connect your first cloud provider and see spend data in under 10 minutes. This quickstart gets you connected to Quper as fast as possible. You will have live spend data and your first AI recommendations before you finish your coffee. {% hint style="success" %} **Estimated time: 10 minutes.** All you need is a Quper account and admin access to at least one cloud provider or data platform. {% endhint %} ## Steps {% stepper %} {% step %} **Sign in to Quper** Log in to your Quper workspace using your credentials or your company's SSO provider. If you don't have an account yet, [book a demo](https://quper.co) to get access. {% endstep %} {% step %} **Connect your first integration** From the left sidebar, go to **Settings → Integrations** and select your cloud provider or data platform. {% tabs %} {% tab title="AWS" %} Quper connects to AWS via an IAM Role. Click **Connect AWS**, then follow the CloudFormation template link to create a read-only IAM role in your account. Paste the Role ARN back into Quper to complete the connection. {% endtab %} {% tab title="GCP" %} Quper connects to GCP via a Service Account. Click **Connect GCP**, download the provided setup script, and run it in your Google Cloud Shell. The script creates a service account with Billing Viewer permissions and returns a credentials JSON to paste into Quper. {% endtab %} {% tab title="Azure" %} Quper connects to Azure via App Registration. Click **Connect Azure**, follow the guided App Registration steps in the Azure Portal, and paste your Tenant ID, Client ID, and Client Secret into Quper. {% endtab %} {% tab title="Snowflake" %} Quper connects to Snowflake via a dedicated read-only user. Click **Connect Snowflake**, run the provided SQL commands in your Snowflake console to create the user and role, and paste your account identifier and credentials into Quper. {% endtab %} {% tab title="Databricks" %} Quper connects to Databricks via a Personal Access Token. Click **Connect Databricks**, generate a token in your Databricks workspace under **User Settings → Access Tokens**, and paste it into Quper along with your workspace URL. {% endtab %} {% tab title="BigQuery" %} Quper connects to BigQuery via a Service Account. Click **Connect BigQuery**, create a service account in Google Cloud IAM with BigQuery Data Viewer and Job User roles, download the key JSON, and upload it to Quper. {% endtab %} {% endtabs %} {% hint style="info" %} Quper uses **read-only access only**. No write permissions are ever requested or required. {% endhint %} {% endstep %} {% step %} **Wait for initial data ingestion** After connecting, Quper begins pulling your billing and usage data. Initial ingestion takes **15–30 minutes** depending on account size and how much historical data is available. You will see a progress indicator in the Integrations panel while ingestion is running. Quper automatically pulls the last 90 days of historical data on first connection. {% endstep %} {% step %} **Explore your Spend Overview** Once data is ready, navigate to **Observe → Spend Overview**. You will see: * Total spend this week vs. last week * Spend breakdown by service, account, and region * Top services by cost * Any anomalies detected during initial ingestion {% hint style="info" %} If Quper detected cost anomalies in your historical data, they will appear in the **Detect → Anomalies** feed immediately. {% endhint %} {% endstep %} {% step %} **Review Vidura AI recommendations** Go to **Decide → Action Intelligence** to see your first set of AI-generated optimisation recommendations. Each recommendation shows: * The resource and the issue * Estimated monthly savings * One-click action to apply the fix Start with the highest-impact items at the top of the list. {% endstep %} {% endstepper %} ## What's next? {% content-ref url="/pages/s9E2om8uuZV2syNKp8x5" %} [Onboarding Your Team](/get-started-with-quper/onboarding) {% endcontent-ref %} {% content-ref url="/pages/N4tcuOR4EmJ5TdaBrFli" %} [Overview](/integrations/integrations) {% endcontent-ref %} {% content-ref url="/pages/wrP7JAym5GYlfGlga9yd" %} [Cost Governance](/user-guide/govern/cost-governance) {% endcontent-ref %} # Onboarding Your Team Invite your team and configure access controls for your Quper workspace. Quper is built for collaboration across FinOps, DataOps, platform engineering, and finance teams. This guide covers how to invite users, assign roles, and set up access controls so every team member sees exactly what they need. ## Inviting users {% stepper %} {% step %} **Go to Settings → Users** From the left sidebar, navigate to **Settings → Users & Access**. Click **Invite User**. {% endstep %} {% step %} **Enter the user's email** Type the email address of the person you want to invite. Quper will send them an invitation link that expires after 48 hours. {% endstep %} {% step %} **Assign a role** Select a role for the new user. Quper ships with three default roles: | Role | What they can do | | ---------- | --------------------------------------------------------------------------------- | | **Admin** | Full access to all settings, integrations, billing data, and user management | | **Editor** | Can view all cost data, create dashboards, set budgets, and apply recommendations | | **Viewer** | Read-only access to cost data, dashboards, and reports | You can also create custom roles with granular permissions. See [Role-Based Access Control](/settings/rbac) for details. {% endstep %} {% step %} **Set data access scope (optional)** If you want to restrict what cost data this user can see, assign them to a **Team** in Settings → Teams. Users in a team only see cost data that is tagged or attributed to that team's resources. This is useful for giving engineering teams visibility into their own spend without exposing company-wide billing data. {% endstep %} {% endstepper %} {% hint style="info" %} Only **Admin** users can invite new members, manage roles, and configure integrations. {% endhint %} ## Setting up Single Sign-On (SSO) Quper supports SSO via SAML 2.0. To enable SSO for your workspace: 1. Go to **Settings → Security → Single Sign-On** 2. Select your identity provider (Okta, Azure AD, Google Workspace, or custom SAML) 3. Enter your IdP metadata URL or upload the metadata XML 4. Map your IdP group attributes to Quper roles 5. Test the connection, then enable SSO enforcement for your domain {% hint style="info" %} Once SSO enforcement is enabled, all users with your company domain must sign in through your identity provider. Password-based login is disabled for those users. {% endhint %} ## Recommended onboarding order For most teams, we recommend this order when setting up Quper for the first time: 1. **Connect integrations** — Get all cloud providers and data platforms connected before inviting the wider team 2. **Invite FinOps lead or admin** — This person configures budgets, tags, and governance policies 3. **Invite platform/engineering leads** — Give them Editor access so they can view anomalies and apply recommendations for their services 4. **Invite finance stakeholders** — Viewer access is typically sufficient for finance teams reviewing spend reports 5. **Invite the wider team** — Use team-scoped access to give individual squads visibility into their own spend ## What's next? {% content-ref url="/pages/N4tcuOR4EmJ5TdaBrFli" %} [Overview](/integrations/integrations) {% endcontent-ref %} {% content-ref url="/pages/UMIgTjQ7De2ZY3olDD5n" %} [Role-Based Access Control (RBAC)](/settings/rbac) {% endcontent-ref %} {% content-ref url="/pages/qh9vGFz6N3BP0O9XQjac" %} [Alerts & Notifications](/settings/alerts) {% endcontent-ref %} # Overview Connect Quper to your cloud providers, data warehouses, and data platforms. Quper connects directly to your infrastructure using secure, read-only access — with no agents to install and no disruption to your existing setup. ## Supported integrations ### Cloud Providers Connect your cloud billing to Quper to get a unified view of compute, storage, networking, and managed service spend across all your accounts and regions. | Provider | What Quper tracks | | ------------------------------------------------------- | ---------------------------------------------------------------------------------------------- | | [AWS](/integrations/cloud-providers/aws) | EC2, RDS, Lambda, S3, EKS, and all other AWS services via Cost and Usage Reports | | [Google Cloud (GCP)](/integrations/cloud-providers/gcp) | Compute Engine, BigQuery, Cloud Storage, GKE, and all GCP services via Billing Export | | [Microsoft Azure](/integrations/cloud-providers/azure) | Virtual Machines, Azure SQL, Blob Storage, AKS, and all Azure services via Cost Management API | ### Data Warehouses & Platforms Connect your data platforms to Quper to track query costs, warehouse utilisation, and job-level spend in real time. | Platform | What Quper tracks | | -------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------- | | [Snowflake](/integrations/data-warehouses-and-platforms/snowflake) | Warehouse credits, storage costs, query spend, idle compute, and credit consumption by user and role | | [Databricks](/integrations/data-warehouses-and-platforms/databricks) | Cluster spend, job costs, DBU consumption, idle clusters, and cost by workspace and team | | [BigQuery](/integrations/data-warehouses-and-platforms/bigquery) | Slot consumption, on-demand query costs, dataset storage, and spend by project and user | ## How integrations work Quper pulls data from each connected platform on a regular cadence: * **Cloud providers** — billing and usage data is refreshed every 24 hours, with real-time usage signals updated every hour * **Data warehouses** — query-level cost data is updated every hour; storage data is updated every 24 hours After connecting a new integration, Quper automatically backfills **90 days** of historical cost and usage data. ## Adding a new integration 1. Go to **Settings → Integrations** 2. Click **Add Integration** 3. Select your provider or platform 4. Follow the step-by-step connection guide Each integration requires read-only credentials only. Quper never requests or stores write access to your infrastructure. ## Removing an integration 1. Go to **Settings → Integrations** 2. Find the integration you want to remove 3. Click the options menu (⋯) and select **Disconnect** 4. Confirm the disconnection After disconnecting, Quper retains your historical cost data but stops ingesting new data from that source. {% hint style="info" %} You can reconnect a previously disconnected integration at any time. Quper will resume data ingestion from the point of reconnection and backfill any gap in data. {% endhint %} # Cloud Providers # Connect to AWS Connect your AWS account to Quper via a read-only IAM Role. Quper connects to AWS using a cross-account IAM Role with read-only permissions. This is the most secure connection method — no access keys are stored, and Quper can only read your billing and usage data. ## What Quper tracks from AWS * All AWS service costs via the Cost and Usage Report (CUR) * EC2 instance usage, instance types, and running hours * RDS, Lambda, S3, EKS, and all other AWS service spend * Reserved Instance and Savings Plan utilisation and coverage * Cost and usage broken down by account, region, service, and tag * Hourly spend signals for real-time anomaly detection ## Before you begin * You must have **IAM administrator access** in the AWS account you want to connect * Quper supports connecting **multiple AWS accounts** — repeat this process for each account, or use AWS Organizations to connect all accounts in bulk ## Connection steps {% stepper %} {% step %} **Go to Settings → Integrations** In your Quper workspace, navigate to **Settings → Integrations** and click **Add Integration → AWS**. {% endstep %} {% step %} **Deploy the IAM Role via CloudFormation** Quper provides a one-click CloudFormation template that creates the read-only IAM Role in your AWS account. Click **Launch CloudFormation Template** — this opens the AWS Console with the stack pre-configured. Review the stack parameters and click **Create Stack**. The stack creates: * An IAM Role named `QuperReadOnlyRole` * A policy granting read-only access to Cost Explorer, Cost and Usage Reports, and CloudWatch * A trust relationship allowing Quper's AWS account to assume the role {% endstep %} {% step %} **Copy the Role ARN** Once the CloudFormation stack status shows **CREATE\_COMPLETE**, go to the **Outputs** tab of the stack and copy the `QuperRoleARN` value. {% endstep %} {% step %} **Paste the Role ARN into Quper** Return to the Quper integrations setup screen, paste the Role ARN, and click **Connect**. Quper will verify the role and begin initial data ingestion. {% endstep %} {% endstepper %} ## Connecting multiple AWS accounts To connect additional AWS accounts, repeat the steps above for each account. Quper will display all connected accounts in a unified view in the Spend Overview, with the ability to filter by account. If you use **AWS Organizations**, you can optionally connect the management account and grant Quper access to all member accounts at once. Contact Quper support for the Organizations setup guide. ## Permissions granted to Quper The IAM Role created by the CloudFormation template grants the following read-only permissions: | Service | Permissions | | ------------------------ | ------------------------------------------------------------------------------------- | | Cost Explorer | `ce:GetCostAndUsage`, `ce:GetReservationUtilization`, `ce:GetSavingsPlansUtilization` | | Cost and Usage Reports | `cur:DescribeReportDefinitions` | | S3 (CUR bucket) | `s3:GetObject`, `s3:ListBucket` | | CloudWatch | `cloudwatch:GetMetricStatistics`, `cloudwatch:ListMetrics` | | Organizations (optional) | `organizations:ListAccounts`, `organizations:DescribeAccount` | Quper does not request and cannot be granted any write permissions through this role. ## Troubleshooting **Quper shows "Role verification failed"** Verify that the CloudFormation stack completed successfully (status: `CREATE_COMPLETE`) and that you copied the full ARN including the account ID. **No data appearing after 30 minutes** Ensure your AWS account has Cost and Usage Reports enabled in **Billing → Cost & Usage Reports**. If CUR is not yet set up, Quper will set up a new report — allow up to 24 hours for the first report to be delivered. **Some services show $0 cost** Certain AWS services report costs with a 24–48 hour delay in CUR. This is expected behaviour from AWS. Quper displays costs as soon as they are available in the report. # Connect to GCP Connect your Google Cloud account to Quper via a Service Account. Quper connects to Google Cloud using a Service Account with read-only Billing Viewer permissions. The service account is scoped to your billing account and cannot modify any GCP resources. ## What Quper tracks from GCP * All GCP service costs via Cloud Billing Export to BigQuery * Compute Engine, Cloud Storage, BigQuery, GKE, Cloud Run, and all other GCP services * Cost and usage broken down by project, service, region, SKU, and label * Committed Use Discount (CUD) utilisation and coverage * Hourly spend signals for real-time anomaly detection ## Before you begin * You must have **Billing Account Administrator** access in GCP * Cloud Billing Export to BigQuery must be enabled in your billing account (Quper can help set this up if it isn't already) * Quper supports connecting **multiple GCP projects** under the same billing account automatically ## Connection steps {% stepper %} {% step %} **Go to Settings → Integrations** In your Quper workspace, navigate to **Settings → Integrations** and click **Add Integration → GCP**. {% endstep %} {% step %} **Create a Service Account** In the Google Cloud Console, go to **IAM & Admin → Service Accounts** and create a new service account: * Name: `quper-readonly` * Description: Quper read-only billing access Grant the service account the following roles at the **billing account** level: * `Billing Account Viewer` * `BigQuery Data Viewer` (on the billing export dataset) * `BigQuery Job User` (on the project containing the billing dataset) {% endstep %} {% step %} **Download the service account key** On the service account details page, go to **Keys → Add Key → Create new key** and select **JSON**. Download the key file. {% hint style="info" %} Store this key file securely. Quper only needs it during setup and stores the credentials encrypted at rest. {% endhint %} {% endstep %} {% step %} **Upload the key to Quper** Back in Quper, upload the JSON key file and enter your GCP Billing Account ID (found in **Billing → Account Management**). Click **Connect**. Quper verifies the service account permissions and begins initial data ingestion. {% endstep %} {% endstepper %} ## Enabling Cloud Billing Export If you haven't already enabled Cloud Billing Export to BigQuery, Quper will prompt you to do so during setup. To enable it manually: 1. In the Google Cloud Console, go to **Billing → Billing Export** 2. Click **Edit Settings** under BigQuery Export 3. Select your project and create or choose a BigQuery dataset 4. Enable **Standard usage cost** and **Detailed usage cost** exports 5. Click **Save** {% hint style="info" %} It can take up to **24 hours** after enabling Billing Export for the first data to appear in BigQuery and in Quper. {% endhint %} ## Troubleshooting **"Permission denied" error during connection** Confirm the service account has been granted Billing Account Viewer at the billing account level (not just the project level). Billing account roles are set in **Billing → Account Management → Permissions**, not in IAM. **No data appearing after 24 hours** Verify that Cloud Billing Export is enabled and that the BigQuery dataset name entered in Quper matches the dataset where your billing export is writing data. # Connect to Azure Connect your Azure subscription to Quper via App Registration. Quper connects to Azure using an App Registration (service principal) with the Cost Management Reader role. This grants read-only access to your billing and usage data across subscriptions. ## What Quper tracks from Azure * All Azure service costs via the Cost Management API * Virtual Machines, Azure SQL, Blob Storage, AKS, App Service, and all other Azure services * Cost and usage broken down by subscription, resource group, resource, region, and tag * Azure Reservations utilisation and coverage * Hourly spend signals for real-time anomaly detection ## Before you begin * You must have **Owner** or **User Access Administrator** access on the Azure subscription or Management Group you want to connect * Quper supports connecting **multiple subscriptions** — you can connect at the Management Group level to cover all subscriptions at once ## Connection steps {% stepper %} {% step %} **Go to Settings → Integrations** In your Quper workspace, navigate to **Settings → Integrations** and click **Add Integration → Azure**. {% endstep %} {% step %} **Create an App Registration** In the Azure Portal, go to **Azure Active Directory → App Registrations → New Registration**: * Name: `Quper-ReadOnly` * Supported account types: Accounts in this organisational directory only * Click **Register** Note the **Application (client) ID** and **Directory (tenant) ID** from the overview page — you will need these in step 4. {% endstep %} {% step %} **Create a client secret** On the App Registration page, go to **Certificates & Secrets → New Client Secret**: * Description: Quper access * Expiry: 24 months (recommended) * Click **Add** Copy the secret **Value** immediately — Azure will not show it again after you leave the page. {% endstep %} {% step %} **Assign the Cost Management Reader role** Go to your **Subscription → Access Control (IAM) → Add Role Assignment**: * Role: `Cost Management Reader` * Assign access to: User, group, or service principal * Select: Search for your App Registration name (`Quper-ReadOnly`) * Click **Review + Assign** Repeat this step for each subscription you want Quper to access. {% endstep %} {% step %} **Enter credentials in Quper** Back in Quper, enter: * **Tenant ID** — your Azure Directory (tenant) ID * **Client ID** — your App Registration Application ID * **Client Secret** — the secret value you copied in step 3 * **Subscription IDs** — one or more subscription IDs to connect Click **Connect**. Quper verifies the credentials and begins initial data ingestion. {% endstep %} {% endstepper %} ## Connecting at Management Group level To connect all Azure subscriptions at once, assign the `Cost Management Reader` role at the **Management Group** level instead of individual subscriptions. Quper will automatically discover and ingest data from all subscriptions under the management group. ## Troubleshooting **"Insufficient privileges" error** Confirm the Cost Management Reader role has been assigned to the App Registration at the subscription or management group level, not just at the resource group level. **Data missing for some subscriptions** If you connected individual subscriptions, make sure the role assignment was made on every subscription. Subscriptions not listed in the Quper setup will not be ingested. # Data Warehouses & Platforms # Connect to Snowflake Connect your Snowflake account to Quper to track warehouse credits and query costs. Quper connects to Snowflake using a dedicated read-only user and role. It tracks warehouse credit consumption, query costs, storage spend, and idle compute — giving you full visibility into where your Snowflake spend is going and which teams or workloads are driving it. ## What Quper tracks from Snowflake * Warehouse credit consumption by warehouse, user, and query type * Storage costs including data storage, failsafe, and stage storage * Query-level cost attribution — spend per query, role, user, and database * Idle warehouse time and auto-suspend performance * Credit usage trends and anomalies in real time ## Before you begin * You must have **ACCOUNTADMIN** access to create the Quper user and role * Quper supports connecting **multiple Snowflake accounts** — repeat this process for each account ## Connection steps {% stepper %} {% step %} **Go to Settings → Integrations** In your Quper workspace, navigate to **Settings → Integrations** and click **Add Integration → Snowflake**. {% endstep %} {% step %} **Run the setup SQL in Snowflake** Quper provides a ready-to-run SQL script that creates a dedicated user and role with read-only access. Run the following in a Snowflake worksheet as ACCOUNTADMIN: ```sql -- Create Quper role CREATE ROLE IF NOT EXISTS QUPER_READER; -- Grant access to billing and usage views GRANT IMPORTED PRIVILEGES ON DATABASE SNOWFLAKE TO ROLE QUPER_READER; -- Create Quper user CREATE USER IF NOT EXISTS QUPER_SERVICE_USER PASSWORD = '' DEFAULT_ROLE = QUPER_READER DEFAULT_WAREHOUSE = '' MUST_CHANGE_PASSWORD = FALSE; -- Assign role to user GRANT ROLE QUPER_READER TO USER QUPER_SERVICE_USER; ``` Replace `` with a strong password and `` with any warehouse that can run lightweight queries. {% endstep %} {% step %} **Enter credentials in Quper** Back in Quper, enter: * **Account Identifier** — your Snowflake account locator (e.g. `xy12345.us-east-1`) * **Username** — `QUPER_SERVICE_USER` * **Password** — the password you set in the SQL above * **Warehouse** — the warehouse name you specified Click **Connect**. Quper verifies the connection and begins ingesting usage and billing data. {% endstep %} {% endstepper %} ## What queries Quper runs Quper queries the `SNOWFLAKE.ACCOUNT_USAGE` schema to pull billing and usage data. These queries are read-only and run once per hour on a small warehouse. Quper's query load on your Snowflake account is minimal — typically less than 1 credit per day. ## Troubleshooting **"Insufficient privileges" error** Confirm that `IMPORTED PRIVILEGES` was granted on the `SNOWFLAKE` database to the `QUPER_READER` role. This is the specific grant that enables access to `ACCOUNT_USAGE` views. **Data has a 45-minute delay** This is expected. Snowflake's `ACCOUNT_USAGE` views have a built-in latency of up to 45 minutes. Quper reflects this accurately in its ingestion timestamps. # Connect to Databricks Connect your Databricks workspace to Quper to track cluster and job costs. Quper connects to Databricks via a Personal Access Token and tracks cluster spend, job costs, DBU consumption, and idle compute — so your data engineering teams have full visibility into what every pipeline and notebook is costing. ## What Quper tracks from Databricks * Cluster-level DBU (Databricks Unit) consumption and dollar cost * Job run costs — spend per job, run, and task * Interactive cluster vs. job cluster cost split * Idle cluster time and auto-termination gaps * Cost breakdown by workspace, cluster policy, and team tag * Spot vs. on-demand instance cost attribution ## Before you begin * You must have **workspace admin** access to create a service principal or personal access token * Quper supports connecting **multiple Databricks workspaces** — repeat this process for each workspace ## Connection steps {% stepper %} {% step %} **Go to Settings → Integrations** In your Quper workspace, navigate to **Settings → Integrations** and click **Add Integration → Databricks**. {% endstep %} {% step %} **Create a Personal Access Token** In your Databricks workspace, go to **User Settings → Access Tokens** and click **Generate New Token**: * Comment: `Quper read-only access` * Lifetime: 365 days (recommended — rotate annually) * Click **Generate** Copy the token value — Databricks will not show it again. {% endstep %} {% step %} **Enter credentials in Quper** Back in Quper, enter: * **Workspace URL** — your Databricks workspace URL (e.g. `https://dbc-abc12345-6789.cloud.databricks.com`) * **Access Token** — the token you generated above * **Cloud Provider** — the cloud platform your Databricks workspace runs on (AWS, GCP, or Azure) Click **Connect**. Quper verifies the token and begins ingesting cluster and job cost data. {% endstep %} {% endstepper %} ## Limitations * Quper reads cluster and job cost data via the Databricks REST API and System Tables. System Tables must be enabled in your workspace for full query-level attribution. * Cost data for job runs is available after the run completes. In-progress jobs appear in usage data but final cost is confirmed on completion. * Quper does not support Databricks on-premises deployments. ## Enabling System Tables (recommended) Databricks System Tables provide the most granular cost and usage data. To enable them: 1. In your Databricks workspace, go to **Catalog → System** (requires Unity Catalog) 2. Enable the `system.billing`, `system.compute`, and `system.lakeflow` schemas 3. Grant the Quper service principal `SELECT` access on these schemas {% hint style="info" %} System Tables require **Unity Catalog**. If your workspace does not have Unity Catalog enabled, Quper will fall back to the Cluster Events API and Jobs API for cost data, which provides less granularity. {% endhint %} ## Troubleshooting **Token authentication fails** Verify the workspace URL does not have a trailing slash and matches the URL you use to access Databricks in your browser. **Job costs not appearing** Ensure the Quper token has at least `CAN_VIEW` permission on the jobs and clusters you want to track. Quper cannot see job runs it doesn't have permission to list. # Connect to BigQuery Connect your BigQuery project to Quper to track query costs and slot consumption. Quper connects to BigQuery via a Service Account and tracks query costs, slot consumption, dataset storage, and spend by project, user, and dataset — giving data teams clear visibility into what is driving their BigQuery bill. ## What Quper tracks from BigQuery * On-demand query costs by project, dataset, table, and user * Slot consumption for flat-rate and reservation-based workloads * Storage costs for active and long-term storage by dataset * Query-level cost attribution — bytes processed, slot hours, and estimated cost per query * Spend trends and anomalies in real time ## Before you begin * You must have **Project Owner** or **BigQuery Admin** access in the GCP project you want to connect * Quper supports connecting **multiple GCP projects** — repeat this process for each project, or connect at the billing account level via the [GCP integration](/integrations/cloud-providers/gcp) to cover all projects automatically ## Connection steps {% stepper %} {% step %} **Go to Settings → Integrations** In your Quper workspace, navigate to **Settings → Integrations** and click **Add Integration → BigQuery**. {% endstep %} {% step %} **Create a Service Account** In the Google Cloud Console, go to **IAM & Admin → Service Accounts** in your BigQuery project and create a new service account: * Name: `quper-bigquery-reader` * Description: Quper BigQuery read-only access {% endstep %} {% step %} **Grant the required roles** Grant the service account the following roles on the project: | Role | Why it's needed | | -------------------------- | -------------------------------------------------- | | `BigQuery Data Viewer` | Read dataset, table, and job metadata | | `BigQuery Job User` | Run INFORMATION\_SCHEMA queries to pull usage data | | `BigQuery Resource Viewer` | Read reservation and slot assignment data | | {% endstep %} | | {% step %} **Download the service account key** On the service account details page, go to **Keys → Add Key → Create new key → JSON**. Download the key file. {% endstep %} {% step %} **Upload the key to Quper** Back in Quper, upload the JSON key file and enter your GCP Project ID. Click **Connect**. Quper verifies the service account permissions and begins ingesting BigQuery cost and usage data. {% endstep %} {% endstepper %} ## How Quper calculates query costs For **on-demand pricing**, Quper calculates query cost using the bytes processed by each job and GCP's published on-demand rate for your region. For **flat-rate and reservation pricing**, Quper tracks slot-hour consumption per project and reservation, and maps it to your committed slot spend to show effective cost per query. ## Enabling INFORMATION\_SCHEMA access Quper uses BigQuery `INFORMATION_SCHEMA.JOBS` to pull per-query usage data. This view is available by default in all GCP projects. No additional setup is required. {% hint style="info" %} INFORMATION\_SCHEMA job data is available for queries run in the **last 180 days**. Quper will backfill up to 90 days of data on initial connection. {% endhint %} ## Troubleshooting **"Access denied" on INFORMATION\_SCHEMA queries** Ensure the service account has `BigQuery Job User` at the project level. The `BigQuery Data Viewer` role alone is not sufficient to run INFORMATION\_SCHEMA queries. **Storage costs not appearing** Confirm the service account has `BigQuery Data Viewer` at the project level. Dataset-level permissions are not sufficient for Quper to enumerate all datasets. # Observe # Spend Overview Get a complete breakdown of every dollar spent across your cloud — in real time. Spend Overview is Quper's unified cost dashboard. It gives you a complete, real-time picture of what you are spending across every connected cloud provider and data platform — broken down by service, account, region, team, and tag. ## What you can do in Spend Overview * **See your total spend** at a glance — current week, month, quarter, or custom date range * **Compare spend periods** — week-over-week, month-over-month, or against any historical window * **Drill down by dimension** — filter by cloud provider, service, account, region, resource tag, or team * **View daily and hourly resolution** — see exactly when spend spiked and which service drove it * **Spot anomalies inline** — active cost anomalies are surfaced directly in the spend chart with markers * **Export data** — download spend breakdowns as CSV for finance and stakeholder reporting ## Spend breakdown dimensions Quper organises your cloud spend by the following dimensions. You can filter and group by any combination: | Dimension | Description | | --------------------- | -------------------------------------------------------------------------------------- | | **Provider** | The cloud provider or data platform (AWS, GCP, Azure, Snowflake, Databricks, BigQuery) | | **Account / Project** | The billing account, GCP project, or Azure subscription | | **Service** | The specific cloud service (e.g. EC2, Cloud Storage, Azure SQL) | | **Region** | The geographic region where the resource runs | | **Resource** | The individual resource instance (where available) | | **Tag** | Any resource tag or label applied in your cloud environment | | **Team** | A team-level attribution based on Quper governance policies | ## Reading the spend chart The main chart in Spend Overview shows your daily spend as a bar chart. Each bar represents one day of total spend across all connected platforms. * **Blue bars** — normal spend within expected range * **Red markers** — days with active anomalies detected by Quper * **Dotted line** — your average daily spend over the selected period (run rate) Hover over any bar to see a breakdown of that day's spend by service or dimension. ## Top Services by spend Below the chart, Quper displays a ranked list of your top cost drivers for the selected period. Each service shows: * Total spend in the period * Percentage of total spend * Trend vs. previous period (up, down, or flat) * An indicator if an anomaly is currently active on that service Click any service to drill into its cost history and resource-level breakdown. ## Filters and saved views Use the filter bar at the top of Spend Overview to narrow the view by any dimension. You can combine multiple filters — for example, filtering to a specific AWS account in us-east-1 with the tag `team:data-engineering`. Save frequently used filter combinations as **Saved Views** for quick access. Saved Views can be made private (personal) or shared with your team. ## Limitations * Spend data is updated every **24 hours** for cloud provider billing, and every **hour** for real-time usage signals * Historical data is available for the last **12 months** after initial connection. Data older than 12 months is available on request * Resource-level attribution (down to individual EC2 instances or queries) requires resource-level tagging to be enabled in your cloud environment ## What's next {% content-ref url="/pages/EFcC7vy9zjhFc5Gm1SLm" %} [Anomalies](/user-guide/detect/anomalies) {% endcontent-ref %} {% content-ref url="/pages/NyaxfrBfdbcjdmMlbxgt" %} [Action Intelligence](/user-guide/decide/action-intelligence) {% endcontent-ref %} {% content-ref url="/pages/wrP7JAym5GYlfGlga9yd" %} [Cost Governance](/user-guide/govern/cost-governance) {% endcontent-ref %} # Detect # Anomalies Detect abnormal cost patterns the moment they emerge — with full root-cause context. Quper detects abnormal cost and usage patterns across all your connected cloud providers and data platforms in real time. Every anomaly alert comes with the full context of what changed, which workload is responsible, and what it is costing per hour — so your team can act immediately instead of waiting for the monthly bill. ## How anomaly detection works Quper's ML-powered detection engine builds a baseline of expected spend for every service, account, region, and resource combination. It continuously monitors incoming usage signals against this baseline and flags deviations that exceed statistical thresholds. Detection happens at two levels: * **Spend anomalies** — unexpected spikes or drops in cost for a service or resource * **Usage anomalies** — unexpected changes in resource consumption patterns (e.g. a warehouse running continuously when it normally auto-suspends) Alerts are generated in real time as anomalies are detected — not on a daily schedule. ## The Anomalies feed Navigate to **Detect → Anomalies** to see all active and historical anomaly alerts. Each anomaly in the feed shows: * **Service and resource** — the specific cloud service and resource driving the anomaly * **Severity** — Critical, High, Medium, or Low based on cost impact and deviation magnitude * **Current usage rate** — the per-hour cost at the time of detection * **Baseline rate** — the normal expected cost for this resource * **Deviation** — how much the current rate exceeds the baseline (e.g. 3.4× normal) * **Running since** — when the anomaly started * **EOD forecast** — projected end-of-day cost if the anomaly is not resolved * **Root cause** — Vidura AI's explanation of what changed and why ## Anomaly severity levels | Severity | Criteria | | ------------ | ------------------------------------------------------------- | | **Critical** | Spend is more than 5× baseline or exceeds $1,000/hr deviation | | **High** | Spend is 3–5× baseline or exceeds $500/hr deviation | | **Medium** | Spend is 2–3× baseline or exceeds $100/hr deviation | | **Low** | Spend is 1.5–2× baseline — informational, worth monitoring | ## Responding to an anomaly Click any anomaly in the feed to open the detail view. From here you can: 1. **Review the root cause** — Vidura AI explains what triggered the anomaly (e.g. "A new EC2 instance was launched in us-east-1 without auto-stop configured and has been running for 2h 14m") 2. **See the affected resource** — drill into the specific instance, cluster, warehouse, or job driving the spike 3. **Apply a recommendation** — if Quper has an automated fix available (e.g. terminate idle instance, resize warehouse), you can apply it with one click 4. **Add a comment** — document why the anomaly occurred for your team's audit trail 5. **Mark as expected** — if the spike is intentional (e.g. a planned data migration), mark it as expected to suppress future alerts for this pattern ## Configuring alerts By default, all Critical and High severity anomalies trigger notifications. You can configure where Quper sends alerts in **Settings → Alerts & Notifications**. Supported notification channels: * Email * Slack * Microsoft Teams * Webhook (for custom integrations) You can set notification rules by severity level, cloud provider, team, or spend threshold. ## Limitations * Anomaly detection requires at least **14 days of historical data** to establish a reliable baseline. During the first 14 days after connecting an integration, detection sensitivity is lower. * A maximum of **150 active anomaly alerts** are displayed in the feed at one time. Alerts are prioritised by cost impact. * Usage anomalies for Snowflake and Databricks have a maximum latency of **45–60 minutes** due to upstream data availability in those platforms. ## FAQs **Why am I seeing anomalies on my first day?** Quper backfills 90 days of historical data when you connect an integration. It uses this history to build an initial baseline and immediately flags any resources that have been behaving abnormally in your historical data. **How do I reduce false positives?** Mark recurring intentional spikes as "expected" patterns. After 3 or more occurrences, Quper learns this is a recurring event and adjusts the baseline accordingly. **Can I set custom thresholds?** Yes. In **Settings → Alerts & Notifications**, you can configure custom alert thresholds per service or team, overriding Quper's default severity classification. # Decide # Action Intelligence Prioritised AI recommendations that tell you exactly what to fix and why it matters. Action Intelligence is Quper's recommendation engine. It surfaces prioritised, impact-ranked optimisation opportunities across all your connected cloud providers and data platforms — so your team knows exactly what to fix, in what order, and what it will save. Every recommendation comes from Vidura AI, which continuously analyses your usage patterns, compares them against efficiency benchmarks, and generates concrete actions with estimated savings. ## What Quper recommends Quper generates recommendations across four categories: ### Rightsizing Resources that are consistently over-provisioned relative to their actual utilisation. Quper identifies instances, warehouses, or clusters running at low utilisation and recommends a smaller configuration. Examples: * EC2 instance running at 8% average CPU → downsize from `m5.2xlarge` to `m5.large` * Snowflake warehouse at 12% average utilisation → resize from Large to Small * Databricks cluster with 4 workers but only using 1 → reduce worker count ### Idle Resources Resources that are running but consuming spend without active workloads. Examples: * EC2 instance with zero network traffic and zero CPU for 72+ hours → terminate or stop * Snowflake warehouse with no queries for 4+ hours and auto-suspend disabled → enable auto-suspend * Databricks interactive cluster running overnight with no attached notebooks → enable auto-termination ### Commitment Optimisation Opportunities to replace on-demand spend with Reserved Instances, Savings Plans, or committed use discounts for predictable workloads. Examples: * EC2 workload with 90%+ on-demand usage over the past 30 days → purchase a 1-year Reserved Instance * Databricks compute with consistent DBU consumption → purchase a DBU commitment ### Configuration Fixes Simple misconfigurations that are causing unnecessary spend. Examples: * Snowflake warehouse with auto-suspend disabled running 24/7 → enable auto-suspend with 10-minute idle timeout * S3 buckets with no lifecycle policy → add lifecycle rules to transition old objects to Glacier * BigQuery tables with no partition expiry → set expiry on large datasets ## The recommendations list Navigate to **Decide → Action Intelligence** to see your full list of recommendations. Each recommendation shows: * **Resource** — the specific service and resource affected * **Issue** — what Quper found and why it is causing unnecessary spend * **Estimated monthly savings** — projected savings if the recommendation is applied * **Effort** — Low, Medium, or High based on the complexity of applying the fix * **Action** — a one-click action for eligible fixes, or step-by-step instructions for manual changes Recommendations are sorted by estimated monthly savings by default. You can re-sort by effort, resource type, or cloud provider. ## Applying a recommendation For eligible resources, Quper provides one-click application of the recommended change: 1. Click **Optimise** on the recommendation 2. Review the proposed change — Quper shows exactly what will be modified 3. Click **Apply** to confirm 4. Quper applies the change and updates the recommendation status to **Applied** One-click actions are available for: * Snowflake warehouse resize * Snowflake warehouse auto-suspend configuration * Databricks cluster auto-termination configuration For AWS, GCP, and Azure resources, Quper provides the recommended action with detailed steps to apply it in your cloud console. Full one-click support for cloud provider resources is on the roadmap. ## Decision trails Every applied recommendation is logged in the **Decision Trail** — an audit history that records: * What was changed * When it was applied * Who applied it * The estimated vs. actual savings after 30 days Decision trails are available for export and are useful for finance reviews, engineering retrospectives, and demonstrating FinOps impact to leadership. ## Limitations * Savings estimates are projections based on current usage patterns. Actual savings may vary if workload patterns change. * Commitment optimisation recommendations require at least **30 days of usage history** before Quper will suggest a commitment purchase. * One-click apply is currently supported for Snowflake and Databricks only. AWS, GCP, and Azure one-click actions are on the roadmap. ## FAQs **How often are recommendations refreshed?** Recommendations are recalculated every 24 hours based on the latest usage data. A recommendation is automatically removed once the underlying issue is resolved. **What if I don't want to act on a recommendation?** You can dismiss a recommendation with a reason (e.g. "Workload is scheduled to increase next quarter"). Dismissed recommendations are hidden from the main list but remain in your recommendation history. **Can I see the impact of recommendations I've already applied?** Yes. Go to the **Decision Trail** to see every applied recommendation and its confirmed savings after 30 days of monitoring. # Govern # Cost Governance Set budgets, enforce tag policies, and prevent ungoverned cloud growth. Cost Governance is Quper's policy enforcement layer. It lets you define the rules for how cloud spend should be managed — budgets, tag requirements, team ownership — and then enforces those rules automatically, alerting your team when policies are breached and preventing ungoverned cloud growth before it compounds. ## Governance Score Quper calculates a **Governance Score** (0–100) for your organisation that reflects how well your cloud environment adheres to your defined policies. The score is updated daily and broken down by policy category. A higher score means more of your infrastructure is governed, tagged, owned, and within budget. Quper shows the score on the Govern dashboard alongside the dollar value of spend that was automatically saved or prevented through policy enforcement. ## Budget Limits Set team-level or service-level budgets to enforce cost ownership across your organisation. ### Creating a budget 1. Go to **Govern → Cost Governance → Budgets** 2. Click **Create Budget** 3. Define the scope — by cloud provider, account, service, tag, or team 4. Set the budget amount and period (monthly or custom) 5. Configure alert thresholds — e.g. alert at 70%, 90%, and 100% of budget 6. Assign budget owners — the users or teams who will be notified on breach ### Budget alerts When spend reaches a configured threshold, Quper notifies the budget owner via their preferred channel (email, Slack, or Teams). Notifications include: * Current spend vs. budget * Projected end-of-period spend (run rate) * Top services driving the overage ### Budget enforcement Beyond alerts, Quper can enforce hard budget caps for supported platforms. When a hard cap is reached, Quper can automatically pause non-critical workloads or trigger a webhook to your automation system for custom enforcement logic. ## Tag Policies Enforce tagging standards across your cloud environment to ensure every resource has an owner, team, environment, and cost centre. ### Creating a tag policy 1. Go to **Govern → Cost Governance → Tag Policies** 2. Click **Create Policy** 3. Define the required tags — e.g. `team`, `environment`, `cost-centre`, `owner` 4. Set the scope — which cloud provider, account, or service the policy applies to 5. Set the enforcement action — Alert only, or Alert + Block untagged resources from being tracked ### Tag compliance reporting Quper shows tag coverage as a percentage of total spend. Resources without required tags are listed in the **Tag Gaps** view with their cost contribution, so your team can prioritise which untagged resources to fix first based on spend impact. Governance reports showing tag compliance are exportable as PDF or CSV for finance and executive reviews. ## Team Ownership Assign cloud resources to teams so that every dollar of spend has a clear owner. Team ownership works alongside tag policies — Quper uses resource tags to automatically map spend to teams, and flags any spend that cannot be attributed to an owner. ### Setting up team ownership 1. Go to **Govern → Teams** 2. Create a team and define its tag-based attribution rules (e.g. all resources tagged `team:data-engineering` belong to the Data Engineering team) 3. Assign team members — they will receive budget alerts and governance reports for their team's spend 4. Set team budgets and tag requirements specific to that team ## Governance Reports Quper generates weekly governance reports that summarise: * Current Governance Score and trend * Budget status across all active budgets * Tag compliance percentage and top untagged resources by spend * Policies that were breached in the last 7 days * Dollar value saved through policy enforcement Reports are delivered to configured recipients automatically each week and are available for export at any time from the Govern dashboard. ## Limitations * Hard budget enforcement (automatic workload pausing) is currently supported for Snowflake and Databricks only * Tag compliance scanning runs every 24 hours — newly created untagged resources may take up to 24 hours to appear in the Tag Gaps view * A maximum of **50 active budget policies** and **20 active tag policies** are supported per workspace ## FAQs **What is a good Governance Score target?** Most FinOps-mature teams aim for a score of 80 or above. A score of 90+ indicates that nearly all spend is governed, attributed, and within budget. Quper's recommendations in the Decide section will help you close the gaps. **Can I create governance policies for a subset of accounts?** Yes. Policies can be scoped to specific cloud accounts, GCP projects, Azure subscriptions, or Snowflake accounts. You can also scope by tag values to target specific environments (e.g. production only). **How is the Governance Score calculated?** The score is a weighted average of four components: budget compliance (30%), tag coverage by spend (30%), team attribution coverage (20%), and idle resource ratio (20%). The weights reflect the typical impact of each factor on cloud cost control. # Vidura AI Overview Quper's AI engine for root cause analysis, anomaly detection, and cost optimisation. Vidura is Quper's built-in AI engine. It monitors hundreds of signals across your cloud infrastructure in real time, performs root cause analysis on cost events, and generates ranked optimisation recommendations — so your team always knows what is happening and what to do about it. Vidura is not a chatbot layered on top of your data. It is the intelligence layer that powers everything Quper does: every anomaly alert, every recommendation, and every root cause explanation comes from Vidura's analysis. ## What Vidura does ### Real-time monitoring Vidura continuously ingests usage and billing signals from all connected cloud providers and data platforms. It processes these signals against learned baselines to detect deviations the moment they occur — not hours or days later. ### Anomaly detection Vidura's ML models build a baseline of expected behaviour for every service, account, region, and resource in your environment. When usage deviates from this baseline, Vidura generates an alert with: * The specific resource and service causing the anomaly * The magnitude of the deviation (e.g. 3.4× normal usage rate) * The per-hour cost impact * A projected end-of-day cost if left unresolved ### Root cause analysis Every anomaly Vidura detects comes with an explanation in plain language. Vidura identifies what changed — a new resource launched without auto-stop, a query pattern that changed, a warehouse that stopped auto-suspending — and surfaces it alongside the alert so your team can act without manual investigation. ### Optimisation recommendations Vidura continuously scans your infrastructure for rightsizing opportunities, idle resources, missing configurations, and commitment gaps. Recommendations are ranked by monthly savings potential and include: * The specific action to take * The estimated monthly savings * A confidence level based on how long the pattern has been observed * One-click application for supported platforms ### Forecast and run rate Vidura projects your end-of-month spend based on current usage trajectory. If a cost anomaly is active, Vidura shows a separate "if unresolved" forecast so you can quantify the impact of inaction. ## How Vidura surfaces its analysis Vidura's outputs appear throughout the Quper interface: | Where | What Vidura shows | | ------------------------ | ------------------------------------------------------------ | | **Spend Overview** | Run rate forecast, anomaly markers on the spend chart | | **Anomalies feed** | Detected anomalies with root cause explanations | | **Action Intelligence** | Ranked optimisation recommendations with savings estimates | | **Governance dashboard** | Policy compliance analysis and gap identification | | **Integration setup** | Initial analysis and first recommendations on data ingestion | ## Vidura's learning period Vidura requires a minimum of **14 days of usage data** to establish reliable baselines for anomaly detection. During this period: * Spend Overview and recommendations are available immediately * Anomaly detection operates at reduced sensitivity with a wider deviation threshold * After 14 days, sensitivity increases and false positive rates decrease significantly Vidura continues to improve its baselines over time as it observes more of your infrastructure's behaviour patterns. ## Data privacy and security Vidura's analysis runs entirely within Quper's secure infrastructure. Your billing and usage data is never shared with third-party AI providers or used to train models outside of your workspace. Vidura's models are trained on your organisation's own cost and usage patterns only. Quper is SOC 2 Type II certified. All data is encrypted in transit and at rest. ## FAQs **Does Vidura have access to my actual workloads or data?** No. Vidura only analyses billing and usage metadata — the same data you see in your cloud provider's billing console. It has no access to the contents of your databases, code, or application data. **Can Vidura make changes to my cloud resources automatically?** Vidura can apply approved optimisations with one-click confirmation in Quper. It does not make autonomous changes to your infrastructure without explicit approval. All actions are logged in the Decision Trail. **How does Vidura compare to my cloud provider's native cost tools?** Native tools (AWS Cost Explorer, GCP Cost Management, Azure Cost Analysis) show you what happened. Vidura explains why it happened and what to do about it — across all your providers in a single place. # Account Settings Manage your Quper workspace settings, billing, and security configuration. Account Settings is where you configure your Quper workspace — your organisation profile, security settings, billing, and workspace-wide preferences. ## Accessing Account Settings Navigate to **Settings → Account** from the left sidebar. Only users with the **Admin** role can view and modify account settings. ## Workspace profile * **Workspace name** — the display name for your organisation in Quper * **Workspace slug** — the URL-friendly identifier used in API calls and exports * **Time zone** — the default time zone used for cost reporting, budget periods, and scheduled reports * **Fiscal year start** — the month your financial year begins, used to align budget periods and financial reports ## Security ### Single Sign-On (SSO) Configure SAML 2.0 SSO to require all users to authenticate through your identity provider. See the [Onboarding](/get-started-with-quper/onboarding) guide for setup instructions. ### Session management * **Session timeout** — set how long inactive sessions remain valid (default: 8 hours, maximum: 30 days) * **Force re-authentication** — require users to re-authenticate before applying optimisation actions ### IP Allowlist Restrict Quper access to specific IP addresses or CIDR ranges. When enabled, users outside the allowed IPs cannot log in or access the Quper API. To enable: 1. Go to **Settings → Account → Security → IP Allowlist** 2. Click **Add IP Range** and enter the CIDR notation (e.g. `203.0.113.0/24`) 3. Add all required ranges including your office IPs and VPN exit nodes 4. Click **Enable Allowlist** {% hint style="info" %} Before enabling the IP Allowlist, ensure your own IP is in the allowlist. Enabling it without including your current IP will lock you out of the workspace. {% endhint %} ## Data retention Quper retains your cloud cost and usage data for **24 months** by default. You can configure a shorter retention period if required for compliance. Raw billing data from connected integrations is retained separately in your cloud provider's billing systems — Quper does not store a copy of the raw data. ## Workspace deletion To delete your Quper workspace, contact . Workspace deletion is irreversible and permanently removes all cost data, configurations, and user accounts associated with your workspace. # Role-Based Access Control (RBAC) Control who can see what in Quper with role-based access and team-level data scoping. Quper's RBAC system lets you control what each user can do and which cost data they can see. Access is managed through two layers: **roles** (what actions a user can take) and **teams** (which data a user can see). ## Default roles Quper ships with three built-in roles that cover most use cases: | Role | Capabilities | | ---------- | ---------------------------------------------------------------------------------------------------------------------------------------------------- | | **Admin** | Full access to all settings, integrations, users, billing data, governance policies, and optimisation actions | | **Editor** | Can view all cost data, create and edit dashboards, configure budgets, apply recommendations, and manage alerts. Cannot manage users or integrations | | **Viewer** | Read-only access to dashboards, cost data, anomaly alerts, and reports. Cannot apply changes or modify any configuration | ## Custom roles If the default roles don't fit your organisational structure, you can create custom roles with granular permission controls. ### Creating a custom role 1. Go to **Settings → Users & Access → Roles** 2. Click **Create Role** 3. Enter a role name and optional description 4. Toggle individual permissions on or off (see the permissions list below) 5. Click **Save Role** ### Permissions list | Permission | Description | | ----------------------- | -------------------------------------------------------------------------- | | `integrations.view` | View connected integrations and their status | | `integrations.manage` | Add, disconnect, and reconfigure integrations | | `spend.view` | View Spend Overview and cost breakdowns | | `anomalies.view` | View anomaly alerts and their details | | `anomalies.manage` | Comment on, dismiss, and mark anomalies as expected | | `recommendations.view` | View Action Intelligence recommendations | | `recommendations.apply` | Apply one-click optimisation actions | | `governance.view` | View governance score, budgets, and tag policies | | `governance.manage` | Create and edit budgets, tag policies, and team ownership rules | | `reports.view` | View and download governance and spend reports | | `reports.schedule` | Create and manage scheduled report delivery | | `users.view` | View the user list and their roles | | `users.manage` | Invite users, assign roles, and remove users | | `settings.view` | View account settings | | `settings.manage` | Modify account settings, security configuration, and workspace preferences | ## Teams and data access scoping Teams allow you to restrict what cost data a user sees. Users assigned to a team only see cost data attributed to that team's resources — they cannot see company-wide spend or data from other teams. This is useful for: * Giving individual engineering squads visibility into their own cloud spend without exposing company billing data * Providing cost ownership to team leads without granting company-wide Admin access * Compliance requirements where finance data must be restricted to specific personnel ### Creating a team 1. Go to **Settings → Users & Access → Teams** 2. Click **Create Team** 3. Enter a team name 4. Define the team's attribution rules — the resource tags that map spend to this team (e.g. `team:data-engineering`) 5. Add team members and assign their roles within the team context 6. Set team-specific budgets and notification preferences (optional) ### How data scoping works When a user is a member of a team with data scoping enabled, Quper filters all cost data to show only resources that match the team's attribution rules. This applies to: * Spend Overview * Anomalies feed * Action Intelligence recommendations * Governance dashboards and reports Users can be members of multiple teams. If a user belongs to multiple teams, they see the combined data from all their teams. ## Managing users ### Inviting a user 1. Go to **Settings → Users & Access → Users** 2. Click **Invite User** 3. Enter the user's email address 4. Select their role 5. Optionally assign them to one or more teams 6. Click **Send Invite** The invitation email expires after **48 hours**. Resend it from the Users list if needed. ### Editing a user's role 1. In the Users list, click the options menu (⋯) next to the user 2. Select **Edit Role** 3. Choose the new role and click **Save** ### Removing a user 1. In the Users list, click the options menu (⋯) next to the user 2. Select **Remove User** 3. Confirm the removal Removed users immediately lose access to the workspace. Their historical activity (comments, applied recommendations) is retained in the audit log. ## RBAC FAQs **Can an Admin lock themselves out of the workspace?** No. Quper prevents the last Admin user from being downgraded or removed. At least one Admin must exist in every workspace at all times. **What happens if I remove a user who owns budgets or governance policies?** Budget and policy ownership is transferred to the Admin who performed the removal. Quper notifies that Admin so they can reassign ownership. **Can I use SSO groups to automatically assign Quper roles?** Yes. When configuring SAML SSO, you can map identity provider group attributes to Quper roles. Users are automatically assigned the correct role when they sign in through SSO. See [Account Settings](/settings/account) for SSO configuration. # Alerts & Notifications Configure where Quper sends cost anomaly alerts, budget notifications, and governance reports. Quper sends notifications for cost anomalies, budget breaches, governance policy violations, and scheduled reports. You can configure where these alerts go — email, Slack, Microsoft Teams, or a custom webhook. ## Notification channels ### Email Email notifications are enabled by default for all users. Each user receives alerts for events relevant to their role and team. To configure email preferences: 1. Go to **Settings → Notifications → Email** 2. Select which event types you want to receive email notifications for 3. Set the digest frequency — immediate, daily digest, or weekly digest ### Slack Connect Quper to your Slack workspace to receive real-time cost alerts in any channel. **Setup:** 1. Go to **Settings → Notifications → Slack** 2. Click **Connect Slack** 3. Authorise the Quper Slack app in your workspace 4. Select the default channel for Quper notifications 5. Click **Save** You can configure different alert types to route to different channels — for example, Critical anomalies to `#incidents` and weekly governance reports to `#finops`. ### Microsoft Teams Connect Quper to Microsoft Teams to receive alerts in any Teams channel. **Setup:** 1. Go to **Settings → Notifications → Microsoft Teams** 2. Click **Add Webhook** 3. In Microsoft Teams, go to your target channel → **Connectors → Incoming Webhook** 4. Create a new webhook and copy the webhook URL 5. Paste the URL into Quper and click **Save** ### Custom Webhook Send Quper notifications to any endpoint that accepts HTTP POST requests — useful for integrating with PagerDuty, OpsGenie, Jira, or your own internal systems. **Setup:** 1. Go to **Settings → Notifications → Webhooks** 2. Click **Add Webhook** 3. Enter your endpoint URL 4. Select the event types to send to this endpoint 5. Optionally add authentication headers 6. Click **Test Webhook** to verify the connection, then **Save** Quper sends webhook payloads as JSON. The payload schema is documented in the API reference. ## Notification event types Configure which events trigger notifications and at what severity level: | Event | Description | | ---------------------------- | -------------------------------------------------------------------------------------------- | | **Anomaly detected** | A new cost anomaly has been detected (configurable by severity: Critical, High, Medium, Low) | | **Anomaly resolved** | A previously detected anomaly has returned to baseline | | **Budget threshold reached** | Spend has crossed a configured budget alert threshold (e.g. 70%, 90%, 100%) | | **Budget exceeded** | Spend has exceeded the budget cap for the period | | **Tag policy violation** | A new untagged resource was detected that violates a governance policy | | **Governance report** | Weekly governance score and compliance summary | | **Recommendation available** | Vidura AI has surfaced a new high-impact recommendation (configurable by savings threshold) | ## Alert routing rules You can route different notification types to different channels. For example: * Critical and High anomalies → Slack `#finops-alerts` + PagerDuty webhook * Budget threshold alerts → Email to budget owners * Weekly governance report → Slack `#finops` + email to finance stakeholders * New recommendations over $1,000/mo savings → Email to FinOps lead To configure routing rules: 1. Go to **Settings → Notifications → Routing Rules** 2. Click **Create Rule** 3. Select the event type and severity filter 4. Choose the destination channel 5. Optionally filter by team, cloud provider, or spend threshold 6. Click **Save** ## Notification limits * Quper will not send more than **1 notification per anomaly per hour** to prevent alert fatigue during active incidents * Budget threshold alerts are sent once per threshold crossing — you will not receive repeated alerts at the same threshold level until the next budget period * A maximum of **10 webhook endpoints** can be configured per workspace ## FAQs **Can I snooze alerts for a specific resource?** Yes. From any anomaly alert, click **Snooze** to suppress notifications for that resource for a defined period (1 hour, 4 hours, 24 hours, or 7 days). The anomaly remains visible in the Anomalies feed — only notifications are suppressed. **Can different team members receive different alerts?** Yes. Each user can configure their personal notification preferences in **Profile → Notifications**. Workspace-wide routing rules set by Admins are applied in addition to personal preferences. **How do I notify a specific person when their team's budget is breached?** Assign budget owners when creating a budget in **Govern → Cost Governance → Budgets**. Budget owners receive notifications automatically when their budget thresholds are crossed, regardless of their general notification settings.