Trust & Security Center

Your infrastructure, untouchable.

CloudAudit was built by DevOps engineers with security as a fundamental principle. We do not touch your data, we only read your metadata.

Goodbye to Access Keys

We do not ask for static credentials or Access Keys (AKIA...). CloudAudit uses Cross-Account IAM Roles with a cryptographically generated unique "External ID" for your user. This protects us and you from "Confused Deputy" attacks.

Temporary role assumption (STS AssumeRole)
Unique External ID per customer

100% Read-Only Architecture

Our baseline policy attaches AWS-managed "SecurityAudit" and "ViewOnlyAccess" permissions. We lack the technical ability to modify resources, terminate instances, or read the data stored inside your databases or S3 buckets.

cloudaudit-policy.json

Open Source

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "securityhub:Get*",
        "securityhub:List*",
        "securityhub:Describe*",
        "trustedadvisor:Describe*",
        "ce:GetCostAndUsage",
        "ce:GetCostForecast",
        "iam:GenerateCredentialReport",
        "iam:GetCredentialReport"
      ],
      "Resource": "*"
    }
  ]
}

Military-Grade Encryption

All traffic to and from CloudAudit is secured via TLS 1.3. At rest, your reports and IAM role metadata are encrypted using AES-256 on our servers.

Zero Core Data Retention

We do not store logs, snapshots, or sensitive configurations long-term. We only store the processed summary (the final report) generated by our AI engine.

Ready to discover vulnerabilities securely?

Start Audit