Privacy Policy

CloudJaeger (“CloudJaeger”, “we”, “us”) provides a cloud cost optimization and FinOps advisory platform. This policy explains what data we collect, why, how we use it, who we share it with, and the choices you have. It covers cloudjaeger.com and the CloudJaeger application.

For privacy questions or to exercise any right below, contact hello@cloudjaeger.com.

We collect three categories of data:

• Account data — your name, email, hashed password (or SSO identity), workspace, and role. Used to authenticate you and scope access.
• Connected-cloud data — when you connect a cloud account, we read (read-only) your billing/cost data (AWS Cost Explorer and, if you enable it, Cost and Usage Report line items), resource inventory metadata (EC2/EBS/RDS/NAT/etc. configuration, tags, attachment state), and CloudWatch utilization metrics. We do not read your application data, object-storage contents, database contents, or secrets.
• Usage data — product analytics and diagnostic/error telemetry (e.g. pages used, API latency, error traces) to operate and improve the service.

You may also optionally upload a billing CSV or push SaaS/LLM/Kubernetes spend to our ingest endpoints; that data is treated as connected-cloud data above.

On AWS we connect via a read-only, cross-account IAM role that you create in your own cloud account from our CloudFormation or Terraform template. The role is protected by a unique external ID. To connect AWS we never ask for, store, or use your AWS root credentials, access keys, or console password. You can revoke our access at any time by deleting the role, and you can disconnect from within the app.

Azure: a read-only service principal you create. We store its client secret, encrypted at the application layer (AES-256-GCM) before it reaches the database; rotate or revoke it in Microsoft Entra ID at any time. Google Cloud: a read-only service account. We store its JSON key, encrypted the same way; disable or delete the key in Google Cloud at any time.

A scheduled export to your own storage is separate from the connection: it stores the credential you give it — an AWS access key pair for an S3 bucket or a Snowflake stage, a Snowflake token, or a BigQuery service-account key — encrypted the same way. An S3 export that uses an IAM role stores no key.

We keep a record of the read calls CloudJaeger’s audited AWS read paths make against your connected AWS accounts — the service, the action, which connection it used, when it ran, and whether it succeeded. Workspace owners and admins can review it at Settings → API activity (sign-in required).

We state that record’s scope precisely rather than claiming it is complete. It covers AWS only. Reads we perform against Azure and Google Cloud are not recorded in it — those connections sync, but their calls do not appear there. A small number of AWS read paths also do not write to it yet: AWS Organizations discovery, native-recommendation import (Compute Optimizer / Trusted Advisor), the idle-resource sweep, and commitment-inventory reads. The API activity page itself lists what is and is not covered, and we update that list when the coverage changes. Access to every cloud account remains read-only regardless of what is logged, and you can revoke it at any time as described above.

Separately, consequential actions taken inside CloudJaeger — applying a recommendation, creating, changing or deleting a budget, changing or removing a member’s role — are written to an append-only, hash-chained workspace audit log that owners and admins can review at Audit log (sign-in required).

This is the part most customers ask about, so we are explicit. CloudJaeger uses a large language model (LLM) for two narrow purposes: writing the plain-English explanation attached to a recommendation when you opt in, and answering list-price questions your own tools send to the pricing API. There is no chat assistant in the product, and nothing in the product waits on an LLM.

• The LLM never decides anything. Every recommendation is produced by a deterministic engine. The LLM only describes a decision already made; it cannot create, modify, or approve a recommendation.
• What we send: for explanations, a compact, already-validated summary — resource type, region, the proposed change, estimated savings, and risk factors. For the pricing API, the pricing question your tool sent. Nothing else.
• What we never send: your cloud credentials or role ARN, raw CUR/billing line items, full resource inventory, account identifiers beyond what is needed, or any secret.
• Our LLM provider (Anthropic) is used under API terms that do not permit training its models on data submitted through its API. See Subprocessors for the current list.

We use data to: operate and secure the service; produce and explain recommendations; track outcomes (applied / rejected / realized savings) so recommendations improve; provide support; and comply with law. We do not generate cross-customer benchmarks from your data today: benchmark sharing would require your recorded, revocable opt-in, and that opt-in does not exist yet — there is no consent field and no setting for it anywhere in the product, so nothing of yours is being pooled and there is nothing for you to turn off. If we build it, it will be off until you switch it on, and this policy will say so before it ships. We do not sell your data or share it with cloud vendors for referral fees.

We use a small set of vetted subprocessors to run the service (hosting and email, and one LLM provider; billing and error tracking are configured but not switched on). The current list, their location, and purpose are maintained at /subprocessors. We will give notice of material changes to that list.

We keep connected-cloud data only as long as needed to provide the service. What happens on deletion depends on how it is initiated:

• Self-serve deletion is immediate and permanent. When you disconnect a cloud account, delete a workspace, or delete your account from within the app, the associated data is deleted right away with no recovery window — export your data first if you need a copy.
• Support-initiated deletions have a 30-day grace window. If you ask us to remove an account or workspace, we deactivate it immediately and an operator permanently purges it after a 30-day grace window (a manual operator step — nothing is deleted automatically, and you can ask us to cancel within the window).
• Workspace audit logs — including the acting user’s email address and IP address — are retained for the life of the workspace for security and audit purposes, and are deleted together with the workspace.

You can request immediate deletion by emailing hello@cloudjaeger.com.

Data is encrypted in transit across the public internet (TLS) and at rest. The cloud and export credentials we store — Azure client secrets, Google Cloud service-account keys, and the keys you give a scheduled export — are also encrypted at the application layer; an AWS connection stores no credential, only the role’s ARN and the external ID in its trust policy. Access is least-privilege and scoped per workspace. We run on AWS in the EU (eu-central-1) for the current beta.

Depending on your location (e.g. GDPR for the EU/EEA, CCPA/CPRA for California), you may have rights to access, correct, export, or delete your personal data, and to object to or restrict certain processing. To exercise these, contact hello@cloudjaeger.com. EU customers can ask for our Data Processing Agreement, which is a draft pending legal review.

Some subprocessors are located in the United States. Where we transfer personal data internationally, we rely on appropriate safeguards such as the EU Standard Contractual Clauses. See the DPA for details.

We may update this policy as the product evolves. Material changes will be communicated in-app or by email. The “last updated” date above always reflects the current version.