Skip to main content

Security

Read-only by design. Everything its cloud roles can touch is listed.

CloudJaeger reads cost and configuration through roles you create and can delete at any time. This page lists what those roles allow, what we never touch, and what we have not earned yet.

01 / What each role can read

What each cloud role can read

Every permission is published. For AWS the list is parsed from the same CloudFormation template you deploy, so it cannot drift from what we ask for.

  • Amazon Web Services

    82 read-only actions in one IAM policy, deployed with CloudFormation or Terraform. Every one is a Describe, a List or a Get.

    AWS: a customer-owned IAM role you create from our CloudFormation / Terraform template — read-only, scoped to cost & inventory APIs. We assume it with short-lived STS credentials, so the connection stores no long-lived AWS access key.

    Optional add-ons are separate and off by default: the detailed bill (CUR) files, the 90-day CloudTrail management-event lookup, one VPC Flow Log destination you name, and the network topology reads that go with it.

    AWS connections: Livereal bills on our own accounts · several-account organisations in testing

    See every action

  • Microsoft Azure

    Cost Management Reader and Reader on the subscription.

    Optional, one feature each: Reservations Reader on the tenant's reservations (Reservations → Role assignment); Management Group Reader on the tenant root management group.

    Azure: a read-only service principal you create. We store its client secret, encrypted at the application layer (AES-256-GCM) before it reaches the database; rotate or revoke it in Microsoft Entra ID at any time.

    Azure connections: Previewreal cost and inventory sync · not yet checked against a real bill

    See the Azure roles

  • Google Cloud

    roles/bigquery.dataViewer on the billing-export dataset; roles/bigquery.jobUser on the project.

    Optional, one feature each: roles/billing.viewer on the billing account; roles/cloudasset.viewer, roles/compute.viewer, roles/monitoring.viewer and roles/recommender.viewer on the project; roles/browser on the organization (or roles/resourcemanager.folderViewer on the folders to include).

    Cost is read from your BigQuery billing export, not the Cloud Billing API.

    Google Cloud: a read-only service account. We store its JSON key, encrypted the same way; disable or delete the key in Google Cloud at any time.

    Google Cloud connections: Previewreal cost and inventory sync · not yet checked against a real bill

    See the Google Cloud scopes

02 / What we never touch

What we never touch

This build has no execution path: nothing is applied to your cloud, with or without an approval.

  • No write to your infrastructure.

    The read-only role describes, lists, and gets; it never creates, modifies, or deletes a resource. Two opt-in exceptions write only where you point them: the optional CUR add-on writes Athena scratch into the CUR bucket you designate, and — if you configure an export destination — the scheduled export writes the dataset into your own S3 bucket, Snowflake table, or BigQuery table using the separate credential you supply for it. This read-only role is not used for that export, and with no destination configured nothing is written anywhere.

  • No application data.

    No database rows, no message queues, no object contents. (The optional CUR add-on reads only your billing-export files.)

  • No logs or secrets by default.

    The standard role reads no CloudTrail, no log group, no Secrets Manager value and no KMS key material. Only if you opt into the separate activity add-on do we read the 90-day CloudTrail management-event LOOKUP and the one flow-log destination you designate — never a trail export, never your log bucket at large, never application logs, and never a secret.

  • No agents or code in the cloud connection.

    It installs nothing: we assume a role and call read APIs. The optional Kubernetes agent is a CronJob you install in your own cluster; it reads your Prometheus and posts daily usage to us.

  • No standing AWS credentials stored.

    For AWS we hold only the role ARN + external id and re-assume each sync.

03 / Your account, leaving, and what we have not earned

Your account — and what we do not claim

Your account Preview

  • Email and password, with optional multi-factor authentication (MFA) through an authenticator app.
  • Sessions end after 30 idle minutes and after 8 hours at most.
  • Sensitive actions ask for your password again.
  • Single sign-on and SCIM are planned; today sign-in is a password, with optional MFA that a workspace owner can require.

Leaving

  • You can revoke our access at any time — delete the AWS role, or revoke the Azure or Google Cloud credential — independent of CloudJaeger.
  • Export your data as CSV or JSON from the product.
  • Deletion is a button: workspace deletion is owner-gated and account deletion is server-confirmed. Deleting a workspace or an account is recorded in our internal audit log; some other deletions are not.
  • Recorded actions go to a hash-chained activity log. Coverage is not universal: some actions do not write to the log. Until the chain is keyed with a secret held outside the database, someone with database access could rewrite it undetected, and this deployment does not hold that key yet. No chain can show that its newest entries were removed. How to verify the chain.
  • Retention, export and deletion are covered in the Data Processing Agreement — a draft pending legal review.

Not claimed yet

  • No SOC 2 or ISO 27001 report. Not certified, and no audit is under way: no auditor is engaged and the SOC 2 observation window has not started.
  • No SLA during the beta — no availability or support-response commitment on any plan today.
  • No customer logos, references or “trusted by”.

Trust centerConnect & permissionsPrivacy policyData processing agreement (draft)Subprocessors

Read the policy, then try the product on the sample estate.

Open the live demo — no signupApply for a design partner slot