Never wake up to a $5,000 cloud bill
FireShield stops a bug or an attack from turning into a five-figure cloud bill on GCP or Firebase, including a surprise Firebase usage limit or Blaze plan spike. It acts the moment Google reports your spend, without waiting for anyone to read an alert.
- prod-api$310/$500 · 62%
- worker-queue$364/$400 · 91%
- public-web$102/$300 · 34%
What is FireShield?
Serverless auto-scales with no ceiling. A bug or an attack won't take your service down; it will scale it up, and your bill with it, exponentially within hours. FireShield acts the moment Google reports your spend (no one has to notice an alert first), so the damage doesn't keep compounding.
Native alerts notify. FireShield acts.
Native billing alerts
- ✕Waits for someone to read the alert and act
- ✕Notifies you, never cuts traffic
- ✕No automatic mitigation of any kind
- ✕Email-only alerts, easy to miss
FireShield
- ✓Acts the moment Google reports the spend
- ✓Optional Soft Kill lets your service degrade itself
- ✓Hard Kill disconnects billing as a last resort
- ✓Alerts you by email, and your team on Slack or Telegram
See where the money goes, project by project
Burndown: will you finish the month on budget?
Your spend so far this month against the ideal pace for your budget, with each day's spend against the daily target. A line running above the pace mid-month is the early warning, before any threshold fires.
Usage by service: where the spend comes from
Pick the Google Cloud services you care about (Cloud Run, Firestore, Cloud Storage…) and see how much of the month's spend each one is, in a pie and stacked into the daily bars.
Every month, side by side
Browse back through past months to compare a quiet month with the one that went wrong.
- Cloud Run48%
- Firestore27%
- Cloud Storage15%
- Other10%
Built to hold the keys to your billing account
- ✓
Zero-secrets onboarding
Link a project by signing in with Google: your token is used once to grant FireShield a native IAM role, and never stored. No private key JSON is ever uploaded.
- ✓
Signed, replay-proof webhooks
Every Soft Kill call is HMAC-SHA256 signed with a 5-minute anti-replay window and constant-time comparison.
Read the Soft Kill integration guide → - ✓
Org isolation, enforced server-side
Every organization's data is scoped by a Firebase custom claim, checked at the data layer, never trusted from the client.
- ✓
Immutable audit log
Every mitigation action, automatic or manual, is recorded and can never be edited or deleted from application code.
Pricing
Starter
$9.90/mo
or $99.90/year, 2 months free
Protect the one project that matters most.
- ✓1 project
- ✓Unlimited budget thresholds
- ✓Email alerts
- ✓Soft Kill and Hard Kill
- ✓Immutable audit log
Unlimited
$19.90/mo
or $199.90/year, 2 months free
Every project you run, with the whole team in the loop.
Everything in Starter, plus:
- ✓Unlimited projects
- ✓Slack and Telegram alerts
- ✓Per-project spend charts
- ✓Spend breakdown by service
Both plans start with a 14-day free trial. Cancel before it ends and you pay nothing. Switch plans or cancel anytime from your dashboard.
Frequently asked questions
How does FireShield know my bill is spiking?+
Google reports each project's spend to FireShield through its budget notifications. The moment a report arrives, FireShield checks it against your thresholds and runs their actions; nobody has to read an email first. How often and how soon Google reports is up to Google.
What does it actually do when a threshold is crossed?+
Whatever you set for that threshold. Every budget starts with a Hard Kill at 100% (disconnecting the project's GCP billing account so spend stops), which you can move or remove. On any threshold you can add alerts (email, Slack, Telegram) and, if you want it, a Soft Kill: a signed webhook to your own infrastructure asking it to degrade service.
Do I need to change my application code?+
No. You link your project by signing in with Google, which grants FireShield an IAM role on its billing account. Nothing to install. Your code only changes if you choose to use Soft Kills: then you add one endpoint to receive the webhook. FireShield never touches your running services directly.
Can FireShield read my source code or infrastructure secrets?+
No. Onboarding is zero-secrets: it uses IAM role grants, not uploaded credentials.
What's the difference between Starter and Unlimited?+
Both protect your projects the same way: unlimited thresholds, email alerts, Soft Kill and Hard Kill. Starter covers one project. Unlimited covers every project you link and adds Slack and Telegram alerts, per-project spend charts, and a spend breakdown by service.
Does FireShield work with Firebase projects?+
Yes. Firebase runs on Google Cloud, so any Firebase project on the pay-as-you-go Blaze plan is a GCP project FireShield can protect. If you've ever hit a surprise Firebase usage limit or a Blaze plan bill that got out of hand, that's exactly the scenario FireShield exists to stop.
