Costory (by 3SR)

Sovereign FinOps reporting for SMBs on Azure

You're spending €500 to €15,000 per month on Azure but don't have the time or FinOps expertise to identify possible optimizations. Off-the-shelf SaaS tools are expensive, multi-tenant, and require your cost data to leave your Azure tenant — incompatible with a sovereignty posture.

Costory is an Azure Managed Application deployed entirely inside your Azure tenant. Each month, it queries the Cost Management API, aggregates your costs by service and resource, then uses an AI model executed locally (Azure AI Foundry) to generate a French-language narrative PDF report — with prioritized optimization recommendations and alerts on suspicious cost spikes. You receive the report by Azure Monitor email with a SAS link valid for 30 days.

What makes us different

• 100% sovereign — your cost data never leaves your Azure tenant. The AI model runs in your tenant (Azure AI Foundry, kind ).
• Predictable pricing — flat monthly fee based on volume scanned, not a percentage of your Azure bill (unlike SaaS competitors).
• 5-minute activation — Marketplace deployment, 3-field wizard, that's it. No custom integration.
• Actionable AI — not a CSV dump. A hierarchized narrative with estimated savings %, top resources, spike alerts.
• Free tier — try without commitment with the Free plan (Phi-4 model, 1 subscription, 100 resources).

Use cases

• SMB tech CIO, 50 employees: identifies 18% savings on under-utilized VMs.
• Mid-market DevOps lead, 200 employees: automates monthly reporting across 5 subscriptions to finance leadership.
• MSP managing 10 customers: Premium plan multi-tenant, 1 report per customer, branding preserved.

Architecture

Costory deploys, in your tenant, into a Resource Group locked read-only:

• PowerShell 7.4 Function App on Azure Functions Linux Y1 (consumption plan)
• Cosmos DB Serverless — cost history, partition by month, conditional TTL per plan
• Azure AI Foundry — local AI model (Phi-4 / GPT-4o-mini / GPT-4o per plan)
• Action Group + Log Alert Rule — monthly Azure Monitor email delivery
• Application Insights + Log Analytics — observability
• Defender for Cloud — security perimeter scan (Premium plan only)

Authentication: Azure Managed Identity exclusively, no keys ever.

Permissions required

At install, the Function App's Managed Identity automatically receives + on the deployment subscription. To analyze multiple subscriptions, you grant manually to the MI on each target (PowerShell script provided in the support page).

Plans