The unified, on-device control plane for multi-cloud.

Cost, governance, and observability for AWS, Azure, and GCP, in one desktop app. Credentials stay in your keyring, calls go direct to the cloud. Built by the senior AWS team at chkmate.

on-device credentials·zero middleman·BYOK AI analyst
The problem

Three tabs. Four logins. Zero alignment.

Cost, governance, and observability live in different vendors. Each one wants cross-account IAM, each one prices per workload, and each one disagrees with the others. The work that should be one conversation becomes four.

Cost

Vantage · CloudHealth · Cloudability

Per-workload pricing. Cross-account IAM. Bills don't reconcile with what dev sees.

Governance

Wiz · Orca · Lacework

Hands keys to a SaaS. Procurement and security teams stall the deal for months.

Observability

Datadog · New Relic · Dynatrace

Eye-watering bills at scale. Vendor lock-in. Doesn't see what cost or governance see.

Security teams block any SaaS that needs cross-account IAM. Procurement stalls for months. Bills don't reconcile with what engineers actually shipped.
The product

One desktop app. Zero cloud middleman.

Four pillars on a single control plane — and every read, every scan, every AI prompt runs from your machine against your accounts. Nothing gets brokered through us.

$

Cost

Account-aware spend, idle resource detection, and reservation coverage — reconciled against what your engineers actually shipped.

Governance

Continuous CSPM-style scans across IAM, encryption, exposure, and compliance baselines. Findings include one-click remediations.

Observability

Health and drift signals stitched from CloudWatch, Config, and the resources you actually own — not a billing-shaped fire hose.

AI Analyst

A built-in Claude analyst (BYOK) that explains findings, prioritizes fixes, and drafts the cleanup plan — without your data leaving the machine.

On-device

Credentials live in the OS keyring. Nothing is uploaded, brokered, or staged elsewhere.

Zero middleman

API calls go direct to AWS, Azure, and GCP. No SaaS sitting between your team and your cloud.

Privacy by default

Cloud data never touches a third-party server. AI is BYOK and runs against local state.

A look inside

See the app in motion.

Four surfaces, one window. Each rendered locally against your accounts. Mock data shown.

chkmate · cost controlprod · 3 accounts
Spend by service · June
EC2
$7,214
RDS
$4,830
S3
$2,910
CloudWatch
$1,742
Other
$1,724
Idle resources
7 unattached EBS volumes$318/mo
3 idle NAT gateways$97/mo
2 stopped RDS > 30 days$1,180/mo
Recoverable$4,120/mo
Architecture

How it works.

The shape of the system is the pitch. Your machine talks directly to your cloud accounts. There is no chkmate-hosted backend sitting in the path.

Your machine

chkmate desktop

OS keyring cloud credentials
Local SQLite cached state
Claude (BYOK) AI analyst
E2E sync (opt-in) team tier
Direct API
no third-party server
in the path
Cloud providers

Read directly

AWSQ1 2027
AzureQ3 2027
GCPQ4 2027
Timing

Why now.

The category is shifting. The incumbents can't follow on-device without burning their business model. We have a clean window to build the trust-first multi-cloud control plane.

01

Multi-cloud is the default

Every serious team runs on two or more providers. Single-cloud governance tools no longer fit reality.

02

SaaS category is saturated

Datadog, CloudHealth, Vantage, Wiz can't go on-device without burning their model. The window is open.

03

AI privacy is now a feature

"Your cloud data never leaves your machine" is exactly the trust signal security-conscious teams now demand.

04

LLM costs collapsed

Claude Haiku and Sonnet pricing makes a built-in AI analyst economically viable inside a desktop app.

Pricing

Per-seat SaaS, on-device delivery.

Pay by seat, cap by cloud account. AI is BYOK in v1 — your Anthropic key, your spend, zero variable cost to us. Billing through Paddle as Merchant of Record.

Solo

TBD / month
1 user5 cloud accountsAI included (BYOK)
Get early access
Recommended

Team

TBD / seat / month
Multi-userEncrypted sync25 cloud accounts
Get early access

Business

TBD / seat / month
SSO + audit logsCustom governance rulesUnlimited accounts
Get early access

Enterprise

Custom
Dedicated supportProcurement-friendlyOn-prem options
Talk to us
Roadmap

12 months of product.

A focused four-quarter delivery plan launching Q1 2027. Closed beta opens the year, we ship publicly through Q2, then bring Azure, GCP, and team features online.

Q1 2027
· Closed beta on macOS + Windows· AWS provider — cost, governance, observability· BYOK Claude analyst built in
Solo workflow polished end-to-end
Q2 2027
· Public beta release· Governance scan library expanded (IAM, encryption, exposure)· One-click remediation drafts
Open access · daily-driver UX
Q3 2027
· Azure provider live· Team workspaces (E2E-encrypted sync)· Shared findings + assignment
Multi-cloud + team collaboration
Q4 2027
· GCP provider live· SSO (SAML / OIDC)· Audit log export + compliance reports
Three clouds · enterprise-ready surface
Clarity first

Common questions.

The short version: your credentials, your data, your cloud. We just ship the desktop app that makes it all legible.

Built by chkmate

Made by the people who architect cloud for a living.

chkmate cloud is built by chkmate, a senior AWS consultancy that designs and ships production infrastructure for government, healthcare, and finance. This product exists because we needed it, and we know cloud deeply enough to build it. Need more than a tool? The same team consults, architects, and builds.

Explore chkmate consulting →
Closed beta

Bring your cloud. Keep your keys.

We are hand-picking a small group of cloud architects and platform leads to shape v1. Leave your email and we'll reach out personally about access.

founder@chkmate.net
Need help shipping it instead?

We also run a consulting practice — AWS architecture, app development, and managed services for fintech, healthtech, and regulated SMEs.

See chkmate consulting →

Join the waitlist

Be first in line for closed-beta invites. No spam — we'll only email you about access.