Lutril vs BetterCloud
BetterCloud is a SaaS management platform built around a no-code workflow engine, hosted in the United States and acquired by CoreStack in 2026. Lutril is access governance for employees and AI agents, hosted in the EU. Where each one fits.
Short answer
Choose BetterCloud if you want a broad SaaS management platform, with spend, file governance and a deep workflow builder, and US hosting is acceptable. Choose Lutril if the job is access governance: reviews whose decisions execute, time-boxed access requested in Slack, Teams or the app UI, HRIS-driven onboarding and offboarding, and AI agents governed through an MCP proxy, with data in the EU and a French-language product. BetterCloud has documented an agent inventory; it has not documented an MCP gateway or prompt DLP.
Where each one starts
BetterCloud
Calls itself the only end-to-end SaaS management platform: one workspace to understand, act on and govern users, apps, spend and AI actors. Founded in 2011, Vista-backed from 2022, acquired by CoreStack in March 2026. Modules for user automation, Google Workspace management, spend and file governance are sold separately.
Lutril
Access governance for employees and AI agents, in one policy layer: discovery from Google Workspace and Microsoft 365, requests in Slack, Teams and the app UI, access reviews that revoke, HRIS-driven lifecycle, and an MCP proxy that checks every agent tool call. Built by a practising CISO, hosted in France.
Capability by capability
| Capability | BetterCloud | Lutril |
|---|---|---|
| SaaS discovery from IdP sign-in and OAuth grants (Google Workspace, Microsoft 365) | YesVia SSO, browser extension and ERP signals; Google Workspace, Microsoft 365, OktaSource 2 | YesGoogle Workspace and Microsoft 365 sign-in signals and OAuth grants, from the day you connect |
| Browser extension for shadow IT and shadow AI discovery | YesChrome extension released March 2026; flags AI tools, allow and deny listsSource 3 | YesChrome extension for the SaaS and AI tools that skip SSO |
| Access reviews whose keep-or-remove decisions execute the revocation | PartialCertification campaigns with keep, remove or downgrade; remediation runs through workflowsSource 4 | YesDecisions execute in the connected tool; proof in the campaign export |
| Access requests and approvals in Slack | YesApprovers approve or deny with one click in SlackSource 5 | YesRequests, approvals and expiry warnings in Slack |
| Access requests and approvals in Microsoft Teams | PartialWorkflow messages via Slack or Teams; Teams approvals not documentedSource 6 | YesSame flow in Microsoft Teams, and in the app UI |
| Just-in-time, time-boxed access that expires on its own | PartialBuilt with a wait-for-duration step, not a request-level expirySource 7 | YesOne hour to seven days; an approver can shorten, never extend; auto-revoked |
| Onboarding triggered by the HRIS | YesBambooHR triggers; Workday hire event starts onboardingSource 8 | YesLucca, PayFit and Eurécia native; other HRIS through the MCP endpoint |
| Offboarding that deprovisions across SaaS, including apps outside SSO | YesOffboarding workflows across many apps, including revoking OAuth grantsSource 6 | YesNative connectors plus a universal MCP endpoint for any tool with an API |
| Shadow AI discovery: AI tools and agents in use | YesApp discovery categorises AI tools; extension flags generative AI loginsSource 9 | YesSign-in logs, mailbox scanning, Chrome extension and code scanning |
| AI agent registry with an accountable owner | PartialAgent governance shows who deployed each agent and its permissions; owner assignment not statedSource 10 | YesOwner, model and scopes on every agent; offboarded like an employee |
| MCP proxy or gateway enforcing policy on agent tool calls | Not documented | YesLutril MCP proxy: policy on every call, WORM log, global kill switch |
| Prompt-level DLP and redaction for LLM traffic | Not documentedDLP add-on scans file content, not LLM traffic | YesDetect and redact PII and secrets in prompts, per-model policy |
| EU hosting and a French-language product | Not offeredDatacenters in the United States; French UI not documentedSource 11 | YesOVHcloud, France; product and documentation in French |
| Compliance evidence exports for SOC 2 and ISO 27001 | PartialAudit-ready evidence exports; no SOC 2 or ISO specific packageSource 12 | YesCampaign export with decisions and revocation proof, one link |
| Native integrations | Yes100+ integrations, 1,000+ actionsSource 1 | YesMore than 55 native connectors plus the universal MCP endpoint |
| Published pricing | PartialPricing page without figures, except a $0 spend tierSource 13 | Not offeredOn request |
Choose BetterCloud if
- You want spend optimisation, file governance and Google Workspace administration in the same product as access.
- Your team wants to build its own branching workflows with waits, approvals and timers.
- US data residency is fine and you are already on BambooHR or Workday.
Choose Lutril if
- Your data has to stay in the EU, or your team works in French.
- You need access reviews whose decisions execute and export as SOC 2 or ISO 27001 evidence, without building a workflow for it.
- Access requests must be time-boxed and approved in Slack, Teams or the app UI, with automatic revocation.
- AI agents are already calling your SaaS tools and you need a registry, an MCP proxy and a kill switch, not only an inventory.
Questions buyers ask
Is BetterCloud an alternative to Lutril for access reviews?
BetterCloud runs access certification campaigns and remediates through its workflow engine. Lutril runs campaigns whose keep-or-remove decisions execute directly in the connected tool and exports the decision and the revocation proof together. If your reviewers live in Slack or Teams and your auditor wants one link, Lutril is the shorter path.
Does BetterCloud govern AI agents?
BetterCloud announced agent governance in June 2026: an inventory of agents, who deployed them and what permissions they hold. We found no public documentation of an MCP gateway that enforces policy on each tool call, or of prompt-level DLP. Lutril ships both, with an owner on every agent and a global kill switch.
Where is the data hosted?
BetterCloud states its datacenters are located in the United States and relies on standard contractual clauses for GDPR. Lutril is hosted at OVHcloud in France with Cloudflare at the edge.
What changed with the CoreStack acquisition?
CoreStack announced the acquisition of BetterCloud on March 31, 2026, positioning the combined company as an AI-native IT operations platform. Terms were not disclosed. Check the vendor's roadmap for how the SaaS management modules evolve.
Sources
- 1BetterCloud homepageread on September 2, 2026
- 2BetterCloud, Shadow IT use caseread on September 2, 2026
- 3BetterCloud, Chrome browser extension announcementread on September 2, 2026
- 4BetterCloud, SaaS application access audit guideread on September 2, 2026
- 5BetterCloud, self-service access provisioningread on September 2, 2026
- 6BetterCloud, anatomy of the perfect offboarding workflowread on September 2, 2026
- 7BetterCloud, Wait for Durationread on September 2, 2026
- 8BetterCloud, BambooHR integrationread on September 2, 2026
- 9BetterCloud, App Discoveryread on September 2, 2026
- 10BetterCloud, introducing the next generation of BetterCloudread on September 2, 2026
- 11BetterCloud, security and complianceread on September 2, 2026
- 12BetterCloud, streamline SaaS app security complianceread on September 2, 2026
- 13BetterCloud pricingread on September 2, 2026
- 14BetterCloud, CoreStack acquires BetterCloudread on September 2, 2026
Lutril wrote this page. Facts about BetterCloud come from their public documentation as of September 2, 2026; states marked "Not documented" mean we found nothing public that confirms or denies the capability. Spotted an error? Write to hello@lutril.com and we will correct it.