Least-privilege access
- A read-only collector for organization and cost data
- Scoped access through AWS CloudFormation, Azure service principals or GCP service accounts
- The option to host the collector in your own cloud account
Security
Least privilege by design, every decision on record.
CloudAlpha reads only what it needs, asks before an account exists, and keeps a history of who decided what.
How we protect you
Four commitments behind every account.
Identity you already trust
- Single sign-on over OIDC through your identity provider
- SCIM 2.0 provisioning, so access follows your directory
- Role-based permissions inside CloudAlpha
Governance by default
- Configurable approvals before any account is created
- Cost center, owner and budget captured at creation
- Every request and decision recorded
Secure engineering
- Every build scanned for leaked secrets, risky code and vulnerable dependencies
- An enforced content security policy and hardened security headers
- Sign-in tokens held in memory, not in browser storage
Found a vulnerability?
Email admin@cloudalphasolutions.com with what's affected, the impact and how to reproduce it. We acknowledge reports within two business days, and good-faith research is welcome. See also our security.txt.
Have a security review to run?
We're happy to walk your security team through how CloudAlpha connects to your clouds and who can do what.