⚡
Do Step 1 first. Deleting or disabling the service account from Google Cloud immediately blocks all API calls — regardless of what CostSave does. Step 2 (removing from CostSave) cleans up stored data.
Step 1
Delete or disable the service account in GCP
Choose the option that fits your situation:
Option A — Delete the service account (permanent, recommended)
1Open Google Cloud Console → top-left menu → IAM & Admin → Service Accounts
2Find the service account created for CostSave (e.g. [email protected]) 3Click the ⋮ menu at the end of the row → Delete → confirm
Option B — Disable the service account (reversible / pause)
1Same path: IAM & Admin → Service Accounts → find the CostSave service account
2Click the ⋮ menu → Disable — all keys for this account are immediately invalidated
3To re-enable later without re-uploading the key: same menu → Enable
Option C — Delete only the specific key (most granular)
1Go to IAM & Admin → Service Accounts → click the CostSave service account name to open its detail page
2Click the Keys tab → find the key created for CostSave (check the creation date)
3Click the Delete icon (trash) next to the key → confirm — only this key is revoked, the account remains
Google Cloud → IAM & Admin → Service Accounts
→ Click ⋮ → Delete → Confirm
✓
Service account deleted / disabled. All GCP API calls from CostSave will immediately fail with 403 Permission Denied.
Step 2
Remove the account from CostSave
This permanently deletes all scan history, resource data, and the encrypted service account key from our database.
1Log in to CostSave → go to your accounts list → click the Google Cloud tab
2Find the GCP account → click ⚙ Manage → Remove Account
3Confirm — the encrypted service account key JSON and all scan results are permanently deleted
✓
All data deleted. The encrypted service account key and all GCP scan results are permanently removed from our database.
Check IAM → Service Accounts
The service account should show as Deleted or Disabled. If you chose Option C (key delete only), the account will still appear but with no active keys.
Check Cloud Audit Logs
Go to Google Cloud → Logging → Logs Explorer → filter by the service account email. After deletion, no new CostSave API calls should appear.
Does removing from CostSave also revoke GCP access?
No. Removing from CostSave only deletes our stored copy of the service account key. You must also delete or disable the service account in GCP (Step 1) to fully revoke access.
Which projects lose access when I delete the service account?
All projects that the service account had IAM bindings on — not just the project it was created in. The roles are removed across every project it was granted access to.
What roles did the CostSave service account have?
Read-only only — roles/viewer, roles/billing.viewer, and roles/monitoring.viewer. No write, create, or delete permissions were ever requested.
I want to delete my entire CostSave account
Log in to CostSave → Settings → Danger Zone → Delete My Account. Verify with OTP. All data is permanently erased. Complete Step 1 first to also revoke GCP access.