Security Overview¶

CertifyClouds is designed with security as a core principle. This document details our security architecture, data handling practices, and compliance support.

Executive Summary¶

Key Principle: Your data never leaves your Azure tenant.

CertifyClouds runs entirely in your Azure environment. We don't access your secrets, credentials, or scanned data. The only communication with our servers is license validation.

Deployment Architecture¶

CertifyClouds deploys as a Docker container in your Azure subscription with all data stored in your own PostgreSQL database.

┌─────────────────────────────────────────────────────────────┐
│  Your Azure Subscription                                     │
│                                                              │
│  ┌─────────────────────┐    ┌─────────────────────────┐     │
│  │ Container App / ACI │    │ Azure PostgreSQL        │     │
│  │ ┌─────────────────┐ │    │ (Your Database)         │     │
│  │ │ CertifyClouds   │─┼────│                         │     │
│  │ │ Application     │ │    │ - Scan results          │     │
│  │ └─────────────────┘ │    │ - Rotation history      │     │
│  │                     │    │ - Alert rules           │     │
│  │ Managed Identity    │    │ - Audit logs            │     │
│  └──────────┬──────────┘    └─────────────────────────┘     │
│             │                                                │
│             ▼                                                │
│  ┌─────────────────────────────────────────────────────┐    │
│  │              Your Key Vaults                         │    │
│  │  - Read metadata (Discovery)                         │    │
│  │  - Rotate secrets (PRO only)                         │    │
│  └─────────────────────────────────────────────────────┘    │
└─────────────────────────────────────────────────────────────┘
                              │
                              │ License validation only
                              ▼
                   ┌─────────────────────┐
                   │ license.certifyclouds│
                   │ .com (Cloudflare)   │
                   └─────────────────────┘

Data Handling¶

What CertifyClouds Accesses¶

What CertifyClouds NEVER Accesses¶

Data Storage Location¶

All data is stored in your Azure PostgreSQL Flexible Server:

• Scan results (metadata only)
• Rotation history
• Sync configurations
• Alert rules
• Audit logs

Authentication & Authorization¶

Azure Authentication¶

CertifyClouds uses User-Assigned Managed Identity - no credentials are stored in the container.

How It Works:

1. Managed Identity created during deployment
2. Azure RBAC grants specific roles
3. Azure AD issues short-lived tokens automatically
4. No service principal passwords in config

Application Authentication¶

CertifyClouds enforces JWT-based authentication on all API endpoints.

Protected Endpoints:

Security Controls¶

Encryption¶

Data at Rest¶

Data in Transit¶

Network Security¶

Default Configuration¶

Outbound Connections¶

License Server¶

Data Flow¶

Your Container ──────> Cloudflare Worker
                            │
  Sends:                    │
  - License key             │
  - App version             │
                            │
  Receives:                 ▼
  - License tier       ┌─────────┐
  - Feature flags      │ KV Store│
  - Expiry date        └─────────┘

Offline Operation¶

• License cached locally after validation
• 7-day grace period if server unreachable
• Full functionality during network outages

What We Log¶

On our license server:

• Timestamp of validation
• License key (for rate limiting)
• Success/failure status

We do not log:

• IP addresses
• Azure resource information
• Scan results or secret data

Compliance Support¶

CertifyClouds helps organizations meet compliance requirements:

Framework Support¶

Supported Frameworks¶

• SOC 2 Type II
• ISO 27001
• PCI DSS
• HIPAA
• CIS Azure Benchmark
• NIST 800-53

Security Best Practices¶

Deployment Recommendations¶

1. Use Private Endpoints for Key Vault and PostgreSQL
2. Enable diagnostic logging on all resources
3. Configure alerts for failed access attempts
4. Restrict network access using NSG rules
5. Use Azure Bastion or VPN for application access

Operational Security¶

1. Rotate your SECRET_KEY periodically
2. Review audit logs regularly
3. Keep CertifyClouds updated
4. Remove unused subscriptions
5. Disable features not in use

Incident Response¶

If you suspect a security incident:

1. Revoke the Managed Identity permissions
2. Review audit logs for unauthorized actions
3. Rotate any secrets that may have been exposed
4. Contact security@certifyclouds.com

Security Contact¶

For security questions or vulnerability reports:

• Email: security@certifyclouds.com
• Response Time: 24-48 hours