Security Overview¶

CertifyClouds is designed with security as a core principle. This document details our security architecture, data handling practices, and compliance support.

Executive Summary¶

Key Principle: CertifyClouds stores your operational data in your Azure environment and never sends secret values or key material to CertifyClouds-operated services.

CertifyClouds runs in your Azure environment. Our services receive license validation and, unless you disable Fleet Visibility, bounded aggregate operational counters. Optional customer-configured integrations can transmit selected data directly from your deployment to destinations you approve. The read-only MCP Connector is one such integration and is disabled by default.

Deployment Architecture¶

CertifyClouds deploys as a container in your Azure subscription with all data stored in your own managed database.

┌─────────────────────────────────────────────────────────────┐
│  Your Azure Subscription                                     │
│                                                              │
│  ┌─────────────────────┐    ┌─────────────────────────┐     │
│  │ CertifyClouds       │    │ Your Database           │     │
│  │ (Container)         │────│                         │     │
│  │                     │    │ - Scan results          │     │
│  │ Managed Identity    │    │ - Rotation history      │     │
│  └──────────┬──────────┘    │ - Alert rules           │     │
│             │               │ - Audit logs            │     │
│             ▼               └─────────────────────────┘     │
│  ┌─────────────────────────────────────────────────────┐    │
│  │              Your Key Vaults                         │    │
│  │  - Read metadata (Discovery)                         │    │
│  │  - Rotate secrets (PRO only)                         │    │
│  └─────────────────────────────────────────────────────┘    │
└─────────────────────────────────────────────────────────────┘
                              │
                              │ License validation only
                              ▼
                   ┌─────────────────────┐
                   │ license.certifyclouds│
                   │ .com                │
                   └─────────────────────┘

Data Handling¶

What CertifyClouds-operated services receive¶

What CertifyClouds does not send to its services¶

Optional customer-authorized MCP data flow¶

When an administrator enables the ENTERPRISE MCP Connector, an approved hosted AI client can call the eight read-only Phase 1 tools. Tool results travel over TLS from the customer deployment to that selected provider and can contain asset names and identifiers, expiry metadata, dependency relationships, compliance findings, or scoped audit events.

CertifyClouds-operated services do not receive those results. The selected AI provider handles them under the customer's provider agreement and configuration. MCP never returns bearer tokens, secret values, private keys, certificate material, or value-shaped hints. Disable the connector in Settings -> MCP Connector to close both the transport and its OAuth metadata paths.

Data Storage Location¶

All data is stored in your Azure PostgreSQL Flexible Server:

• Scan results (metadata only)
• Rotation history
• Sync configurations
• Alert rules
• Audit logs

Authentication & Authorization¶

Azure Authentication¶

CertifyClouds supports User-Assigned Managed Identity (recommended) and Service Principal authentication.

How It Works:

1. Managed Identity is the preferred path with no long-lived credentials in the container
2. Service Principal is supported when MI is unavailable
3. Azure RBAC grants specific roles
4. Azure AD issues short-lived tokens automatically

Application Authentication¶

CertifyClouds separates browser-session authentication from MCP resource-server authentication.

Protected Endpoints:

Security Controls¶

All security thresholds are configurable via environment variables.

Encryption¶

Data at Rest¶

Data in Transit¶

Network Security¶

Default Configuration¶

Remote MCP clients are an optional exception to the internal-only application pattern. When MCP is enabled, the deployment's existing gateway must expose only the MCP transport and OAuth protected-resource metadata paths to the approved hosted client. CertifyClouds still validates the Entra token, client, user, scope, tenant, and tool policy on every MCP request.

Outbound Connections¶

Hosted MCP traffic is inbound from the selected provider to the existing CertifyClouds HTTPS route. It does not require a separate MCP service or hostname. See the MCP Connector guide for the exact paths and edge-policy requirements.

License Server¶

Data Flow¶

On startup and periodically, CertifyClouds contacts the license server with your license key and app version. The server responds with your entitlements (tier, feature flags, expiry date). No Azure data, secrets, or scan results are ever transmitted.

Offline Operation¶

• License cached locally after validation
• 7-day grace period if server unreachable
• Full functionality during network outages

What We Log¶

On our license server:

• Timestamp of validation
• License key (for rate limiting)
• Success/failure status
• App version (so we can ship targeted update notices)
• When fleet visibility is enabled (default, opt-out in Advanced Settings): aggregate operational counts and timestamps from your install

We do not log:

• Azure resource information (names, IDs, tags)
• Scan results, secret values, certificate material, or any credential data
• Audit log contents
• User-identifying information

Compliance Support¶

CertifyClouds is an evidence aggregator for Azure credential-lifecycle controls - it identifies findings, recommends remediation, and produces auditor-grade evidence packages. It is not a certified compliance product. See the Compliance Disclaimer for the full framing of what we evidence vs what remains a customer responsibility.

How CertifyClouds contributes¶

Framework evidence mappings¶

CertifyClouds maps its findings to control families in:

• HIPAA Security Rule §164.312
• PCI-DSS v4.0
• SOC 2 Type II
• ISO 27001 / ISO 27002
• NIST 800-53 Rev. 5
• CIS Azure Foundations Benchmark
• Azure Security Benchmark

Security Best Practices¶

Deployment Recommendations¶

1. Use Private Endpoints for Key Vault and PostgreSQL
2. Enable diagnostic logging on all resources
3. Configure alerts for failed access attempts
4. Restrict network access using NSG rules
5. Use Azure Bastion or VPN for application access

Operational Security¶

1. Rotate your SECRET_KEY periodically
2. Review audit logs regularly
3. Keep CertifyClouds updated
4. Remove unused subscriptions
5. Disable features not in use

Incident Response¶

If you suspect a security incident:

1. Revoke the Managed Identity permissions
2. Review audit logs for unauthorized actions
3. Rotate any secrets that may have been exposed
4. Contact security@certifyclouds.com

Security Contact¶

For security questions or vulnerability reports:

• Email: security@certifyclouds.com
• Response Time: 4 UK business days for standard security inquiries; urgent Enterprise paths are defined in the signed support agreement