FinOps for Confluent Cloud · on Azure Marketplace
See where every Confluent Cloud dollar goes, before the invoice does.
Guaiaca connects to your Confluent Cloud organization with a read-only key, ingests costs every day and turns them into trends by environment, cluster, connector and region. Twelve months of history on the first morning.
Read-only. No agents, no changes to your clusters.
Net cost
$17,380
Gross
$22,430
Discount
$1,550
Oct/26 vs Sep/26
8.4%
Net cost by product
Ranking · Oct/26 · 5 items
All · viewing by Product
- KAFKA$12,77061%
- FLINK$4,18020%
- CONNECT$2,64013%
- STREAM_GOVERNANCE$1,2906%
- CREDIT-$3,500-17%
Built for the way Confluent bills
Daily visibility where the console gives you a monthly total.
Confluent Cloud publishes costs with up to 72 hours of delay and the console shows totals. Guaiaca stores every daily line per resource, so a runaway connector or an oversized cluster shows up in days, not at month end.
- to connect an organizationa service-account key, validated before it is stored
- 5 min
- of history on day oneautomatic backfill, the maximum the Billing API allows
- 12 months
- sync with late correctionsa rolling five-day window catches Confluent's revisions
- Daily
- to your Confluent accountevery call is a logged GET
- 0 writes
What you get
The analysis your FinOps team would build, ready on the first login.
- 01
Drill down to the line
Product → usage type → environment → cluster or connector → region → month. Seven chart types, one click to go deeper, breadcrumbs to come back.
- 02
Filters that follow the period
Clusters, connectors and Flink pools in separate pickers, offering only what had usage in the months you selected. Free-text search across every dimension.
- 03
Discount scenarios
Type the rate you are negotiating with Confluent and see the invoice change per product or cluster, next to what you pay today. Credits are never discounted twice.
- 04
Credits read as credits
Promo and commitment credits appear as a negative line with their own share, instead of hiding what each product really costs.
- 05
Several organizations, one view
Connect every Confluent organization of your company and compare them in the same explorer, with organization as a dimension.
- 06
Names, not only IDs
With the Operator role, Guaiaca enriches lines with environment and cluster names, cloud provider and region, and keeps the last known name after a cluster is deleted.
How it works
Three steps, no agents.
- 1
Subscribe on Azure Marketplace
Guaiaca is billed through your Azure subscription. Sign in with your Microsoft Entra ID account; your tenant is created on the first login.
- 2
Connect your Confluent organization
Create a service account with the BillingAdmin and Operator roles, generate a Cloud API key and paste it. Guaiaca validates the permissions before storing the secret, encrypted.
- 3
Explore and act
The twelve-month backfill runs in the background and the daily sync keeps the data fresh. Your whole team sees the same numbers; only tenant admins can connect or disconnect.
Security and trust
Designed to be safe to hand to a platform team.
Guaiaca never touches your clusters. It reads billing data with a key you control and keeps it isolated per tenant.
Microsoft Entra ID single sign-on
Users sign in with their corporate account. App roles separate who can read and who can administer: only your tenant admins connect, sync or disconnect organizations.
Secrets in Azure Key Vault
The Confluent API secret is envelope-encrypted with a Key Vault key through managed identity. The database holds only ciphertext and the key id.
Isolated per customer
Your data is isolated per tenant at the database layer. Nobody outside your organization can read it, by construction, and Guaiaca only serves it to your signed-in users.
Read-only by construction
No Guaiaca component ever writes to Confluent Cloud. Every call is a GET and is logged with the key id, never the secret.
Assisted support, only if you opt in
Datatchê has no access to your data by default. Assisted support, where our team sees your dashboards in read-only mode to help you, is an optional paid add-on you switch on.
Hosted on Microsoft Azure
Guaiaca runs on Microsoft Azure following Microsoft's security and operations best practices. Datatchê is a certified Microsoft Azure partner.
Pricing
Pay per seat and per connected organization, on your Azure invoice.
Two dimensions, both on the Azure bill you already have: the seats your team uses and the Confluent Cloud organizations you connect. No contract outside the Marketplace.
- Seats for the people who read the dashboards
- One line per connected Confluent Cloud organization
- Twelve months of history included with every organization
- Cancel from the Azure portal at any time
Questions
Before you connect
Which Confluent permissions does Guaiaca need?
A Cloud API key of a service account with the BillingAdmin role at the organization level, which is the minimum Confluent accepts for the Costs API. The Operator role is optional and only adds environment and cluster names, provider and region.
Can Guaiaca change anything in my Confluent account?
No. Guaiaca only issues GET requests to the Billing and Organization APIs, and the key you create can be revoked in Confluent Cloud at any time.
How fresh is the data?
Confluent publishes costs with up to 72 hours of delay. Guaiaca syncs every day with a rolling five-day window, so late corrections are picked up, and you can trigger a sync by hand.
Do I need an Azure subscription?
Yes. Guaiaca is a SaaS offer on Azure Marketplace, billed through your Azure subscription. Your Confluent clusters can run on any cloud.
Where is my data stored?
On Microsoft Azure, isolated per tenant. When you disconnect an organization its lines are hidden immediately and purged after 90 days.
Can several people use it?
Yes. Everyone in your Microsoft Entra tenant can sign in, and each active user takes one seat of your plan. Only users with the tenant admin role can connect, sync or disconnect organizations.
Know your Confluent Cloud bill before it arrives.
Connect your first organization today and have twelve months of history by tomorrow morning.