Privacy Policy

KloudLytics ("we", "our", "us") operates the KloudLytics platform — an agentless AWS Cloud Security Posture Management service available at kloudlytics.com and app.kloudlytics.com. If you have questions about this policy, contact us at privacy@kloudlytics.com.

We collect the following categories of information:

Account data — your name and work email address when you register. Your password is handled by our sign-in provider, Amazon Cognito; we never see or store it. If you sign in with Google or Amazon, we receive your name and email address from them.

AWS scan data — configuration read from your AWS environment through the read-only role you create: resource settings, IAM policies, and whether services are enabled. We do not read object contents (such as S3 objects), database contents, values held in Secrets Manager or Parameter Store, or log events. Some configuration, such as environment variables and instance user data, can contain a credential if one was put there; a scan reads that configuration in order to flag it. Every permission and every API call is listed at kloudlytics.com/aws-permissions.

Source code — only if you connect a GitHub repository: the code is read to scan it, and findings are stored. To write an explanation and a fix for a finding of medium severity or above, the flagged lines and up to 300 lines of the surrounding file are sent to Amazon Bedrock inside our AWS account. They are not redacted.

Billing data — if you subscribe, your card details are entered on Stripe's checkout page and never reach us. We store a Stripe customer and subscription reference.

Usage data — pages visited, features used, scan frequency, and error events, collected via server-side logs and, on this website and only with your consent, Google Analytics. No advertising trackers are used.

Communications — any emails or support messages you send us.

We use collected data solely to:

- Provide, operate, and improve the KloudLytics platform - Generate security reports and posture scores for your AWS accounts - Send transactional emails (scan completion, invitation acceptance, password reset) - Respond to support requests - Detect abuse or policy violations - Comply with legal obligations

We do not sell your data, and we do not use it to train machine-learning models. AI explanations and fixes run on Amazon Bedrock inside our AWS account; AWS states that Bedrock does not use prompts or responses to train its models or share them with model providers.

AWS scan data collected from your account is stored encrypted on AWS in London (eu-west-2). It is never shared with other customers or used to benchmark your environment against others. How long it is kept is set out in section 9. You can request deletion at any time by contacting support@kloudlytics.com.

We share data only with:

Service providers — Amazon Web Services (hosting, storage and AI processing), Stripe (payments), a transactional email provider, HubSpot (messages sent through the contact form on this website) and, only if you accept analytics on this website, Google. A full list is available on request.

Legal requirements — when compelled by a valid court order, subpoena, or applicable law. We will notify you of such requests unless legally prohibited from doing so.

We never share your data with advertisers.

Data is encrypted in transit with TLS and at rest. Scans use temporary AWS credentials that expire on their own; we hold no long-lived access keys for your AWS account. Access to production systems is restricted to authorised personnel. More detail is at kloudlytics.com/security.

Depending on your jurisdiction, you may have the right to access, correct, export, or delete your personal data. To exercise any of these rights, email privacy@kloudlytics.com. We will respond within 30 days. Users in the EU / EEA are covered by GDPR; users in California are covered by CCPA.

The KloudLytics application uses only strictly necessary cookies, to keep you signed in. This website stores your theme preference and your cookie choice in your browser. If you accept analytics, this website also loads Google Analytics, which sets cookies and sends usage data to Google so we can see which pages are read. It does not load unless you accept, and you can change your choice at any time with "Cookie settings" at the bottom of any page. We do not use advertising cookies.

Account data is kept for the lifetime of your account. Scan history is available for 30 days on Free, 90 days on Pro, 365 days on Business; after that a scan's detail is archived while its score and finding counts are kept. A plan change is followed by a 30-day grace period before anything is archived, and upgrading to a longer window brings archived detail back. Archives are held for at most five years.

Deleting your account removes your organisations, connected AWS accounts, scan data, archives and your login. It is permanent and cannot be undone by support. Deleted data leaves our database backups as they expire, within 7 days. Payment records are held by Stripe.

We will notify you by email at least 14 days before any material change to this policy takes effect. Continued use of the service after that date constitutes acceptance of the updated terms.