Snapshot 166745
Normalized text
Scripts and page chrome removed; this is what change detection compares.
We use cookies We use cookies to enhance your browsing experience, serve personalized content, and analyze our traffic. By clicking "Accept", you consent to our use of cookies. Read our Cookie Policy for more information. Security Back to Home Trust Center Security, Privacy & Compliance Quick Links Privacy PolicyTerms of ServiceCookie PolicyData Processing Addendum Security is the foundation of Cloudevolve. Our platform is architected from the ground up to protect your cloud environment, with a read-only design that ensures we never modify your infrastructure. Every layer — from network perimeter to application logic — is built with defense-in-depth principles, independently audited, and continuously monitored. Read-Only Architecture Cloudevolve operates on a strictly read-only architecture. We never create, modify, or delete any resources in your cloud environment. Our platform only reads metadata and telemetry data necessary for cost optimization and governance analysis. When you onboard, you create a cross-account IAM role in your own AWS, Azure, or GCP console using our pre-built CloudFormation or Terraform templates. These templates request only the minimum read-only permissions needed — such as ce:GetCostAndUsage, ec2:Describe*, and s3:GetBucketTagging — with no write or delete actions. This architecture means that even in the unlikely event of a breach of Cloudevolve's systems, an attacker could not modify, delete, or disrupt any of your cloud resources. Your infrastructure remains entirely under your control at all times. Authentication & Access Control Cloudevolve enforces robust authentication and access control across the platform: Multi-Factor Authentication (MFA) is required for all user accounts and can be enforced at the organization level. Single Sign-On (SSO) integration via SAML 2.0 and OpenID Connect supports identity providers like Okta, Azure AD, Google Workspace, and OneLogin. Role-Based Access Control (RBAC) provides granular permissions with pre-defined roles (Admin, Editor, Viewer) and the ability to create custom roles. Session Management includes configurable idle timeouts, concurrent session limits, and forced logout capabilities for administrators. API Authentication uses short-lived JWT tokens with automatic refresh, scoped to specific permissions and resources. All authentication events — logins, failed attempts, MFA enrollments, and role changes — are logged in the audit trail. Data Encryption All data handled by Cloudevolve is encrypted both in transit and at rest: In Transit: All connections use TLS 1.3, with TLS 1.2 as a backward-compatible minimum. We enforce HSTS, certificate pinning for mobile clients, and perfect forward secrecy across all endpoints. At Rest: Data stored in our databases and object stores is encrypted using AES-256 through AWS KMS. Encryption keys are automatically rotated annually, and key access is restricted to specific service roles with CloudTrail logging. Inter-Service: All internal microservice communication occurs over mTLS within our private VPC, ensuring zero trust between services. Secrets Management: API keys, tokens, and credentials are stored in AWS Secrets Manager with audit logging and automatic rotation. Network Security Our network architecture follows a defense-in-depth model: Private VPC Deployment: All application workloads run within private subnets with no direct internet exposure. Only load balancers and API gateways have public endpoints. Web Application Firewall (WAF): AWS WAF rules protect against OWASP Top 10 threats including SQL injection, XSS, and request forgery. DDoS Protection: AWS Shield Advanced provides always-on network flow monitoring and automatic DDoS mitigation. Network Segmentation: Production, staging, and development environments are fully isolated with separate VPCs, security groups, and IAM boundaries. Egress Controls: Outbound traffic from application subnets is restricted to known, approved destinations via NAT gateway and security group rules. Vulnerability Management We maintain a rigorous vulnerability management program: Automated Scanning: Every code commit is scanned with static application security testing (SAST) and software composition analysis (SCA) in our CI/CD pipeline. Container images are scanned before deployment. Penetration Testing: We engage independent, third-party penetration testing firms to conduct comprehensive application and infrastructure tests at least annually. Critical findings are remediated within 48 hours. Dependency Management: We monitor all third-party libraries for known CVEs using Snyk and Dependabot, with automated pull requests for critical patches. Bug Bounty: We operate a responsible disclosure program and welcome reports from security researchers. Reports are acknowledged within 24 hours and triaged within 72 hours. Patch Cadence: Critical vulnerabilities are patched within 24 hours, high-severity within 7 days, and medium within 30 days. Secure Development Lifecycle Security is embedded in every stage of our software development lifecycle: Secure Coding Standards: All engineers complete annual secure coding training and follow OWASP-aligned coding guidelines. Code Review: Every pull request requires at least two peer reviews, including a security-focused review for any changes to authentication, authorization, or data handling. CI/CD Security Gates: Our pipeline includes linting, SAST, SCA, container scanning, and infrastructure-as-code (IaC) policy checks. Builds with critical findings are blocked from deployment. Environment Isolation: Development, staging, and production environments are fully isolated with separate credentials, databases, and network boundaries. Change Management: All production deployments are tracked, reversible, and require approval from at least one senior engineer. On this page Security Contact security@cloudevolve.com We use cookies We use cookies to enhance your browsing experience, serve personalized content, and analyze our traffic. By clicking "Accept", you consent to our use of cookies. Read our Cookie Policy for more information.