You trust us with security data. We take that seriously.
What access KloudLytics has, where your data goes, how long it is kept and how it is removed. Written to answer a security review.
How access works
You create the role
A read-only IAM role in your account, from a template you can read in full before you run it.
We assume it for a scan
KloudLytics asks AWS for temporary credentials, presenting the external ID that is unique to you.
The credentials expire
Sessions are capped at 60 minutes by the role itself. No AWS access keys are stored.
Access to your AWS account
- Agentless. Nothing is deployed in your account: no agent, no Lambda function, no software of any kind.
- Read-only. The role you create carries AWS's SecurityAudit and ViewOnlyAccess policies and 54 additional read actions, each listed with its reason. No policy we author contains a write action.
- A role you own. It lives in your account, and deleting it ends our access immediately.
- An external ID unique to you, and a trust policy that names the one role in our account allowed to assume yours.
- No stored AWS keys. Each scan requests temporary credentials from AWS, and the role caps a session at 60 minutes.
Where your data is stored
- The application, its database and scan storage run on AWS in London (eu-west-2).
- This website is hosted separately and holds no scan data.
Encryption
- In transit: TLS between your browser and KloudLytics, between KloudLytics and AWS, and on database connections.
- At rest: the database and its backups are encrypted, and storage buckets use AES-256 with all public access blocked.
- Credentials you give us for alert destinations, such as Slack tokens and webhook secrets, are encrypted again inside the database.
Separation between customers
- Every request is tied to an organisation, and every query is limited to that organisation in application code.
- Row-level security enforced by the database itself is planned and is not yet in place. We would rather say so than imply it.
What is sent to AI
- AI explanations and fixes run on Amazon Bedrock inside our AWS account, in the same region as the rest of the service. Nothing is sent to an AI provider outside AWS.
- For cloud findings, ARNs, AWS account IDs and IP addresses are replaced with placeholders before the request is made.
- For code findings, the model needs the code. The flagged lines and up to 300 lines of the surrounding file are sent as they are, for findings of medium severity and above. They are not redacted. The copy held for this is cleared once the fix is written.
- AWS states that Amazon Bedrock does not use prompts or responses to train its models and does not share them with model providers.
How long data is kept
- Scan history is available for 30 days on Free, 90 days on Pro, 365 days on Business.
- After that window a scan's detail is archived, while its score and finding counts are kept so trends stay intact. A plan change is followed by a 30-day grace period before anything is archived, and upgrading to a longer window brings archived detail back. Archives are held for at most five years.
- Database backups are kept for 7 days.
Deletion
- Deleting your account removes your organisations, connected accounts, scan data, archives and your login.
- It is permanent. There is no recycle bin and no recovery by support, so export what you need first. The app tells you exactly what will be removed before you confirm.
- Deleted data leaves database backups as those backups expire, within 7 days.
Payments
- Card details are entered on Stripe's checkout page and never reach KloudLytics. We store a Stripe customer and subscription reference, and nothing else about your card.
Built by engineers who operate production AWS
KloudLytics is run the way it tells you to run your own account: least-privilege roles, a web application firewall in front of the API, encrypted storage and secrets held in a managed secret store. Judge it on the permissions it asks for, the checks it runs and the frameworks it maps.
Contact
- Report a vulnerability
- security@kloudlytics.com
- Privacy and data requests
- privacy@kloudlytics.com
See also the privacy policy and terms of service.
Security questions
What AWS permissions does KloudLytics require?
A read-only cross-account IAM role with AWS's SecurityAudit and ViewOnlyAccess managed policies and 54 additional read actions. Every action and the reason for it is listed on the AWS permissions page. No policy we author contains a write action.
Does KloudLytics install anything in my AWS account?
No. KloudLytics is agentless. The only thing created in your account is the IAM role, and you create it yourself.
Can KloudLytics change or delete my resources?
No. The role has no write permissions, and fixes are shown for you to review and apply yourself.
Does KloudLytics read the contents of my S3 buckets or databases?
No. A scan reads how resources are configured, not what they hold. It does not read S3 objects, database contents, Secrets Manager values, Parameter Store values or log events.
Is my source code sent to an AI model?
Only if you connect a repository. For code findings of medium severity and above, the flagged lines and up to 300 lines of the surrounding file are sent, unredacted, to Amazon Bedrock inside our AWS account to write the explanation and fix.
Where is my data stored?
On AWS in London (eu-west-2): the application, its database and scan storage.
How do I revoke access?
Delete the IAM role in your AWS account, or remove the account in KloudLytics. Deleting the role ends access immediately.
How do I report a security issue?
E-mail security@kloudlytics.com with what you found and how to reproduce it.
Find out what is actually exposed in your AWS environment.
Connect one AWS account and run your first security assessment.
No credit card · Agentless · Read-only