Security
Scoped access, in your account, revocable at any time.
We don't hold your infrastructure. We get limited, temporary access to operate it, and every action shows up in your own logs.
How access works on AWS
AWS is where most of our early-access teams run. This is exactly what you're granting.
- 01
Cross-account IAM role with an external ID
On AWS, you create a role in your account from a CloudFormation quick-create link. You can read the template before you click Create. The role trusts only our AWS account and requires an external ID unique to you, which protects against the confused-deputy problem.
- 02
Least-privilege permissions
The role grants only what's needed to deploy and operate the services in your plan. It can't touch billing settings, other IAM users, or services we don't manage.
- 03
Short-lived credentials
We assume the role through AWS STS and get temporary credentials that expire automatically. We never ask for, store, or use long-lived access keys.
- 04
No root or password access
We never need your root account, console password, or MFA device. If anyone asks for them in our name, it isn't us.
- 05
Audit log of every action
Every API call we make is recorded by AWS CloudTrail in your account, under our role's name. You can see exactly what we did and when, independent of anything we report.
- 06
Approval required for production changes
Changes to production arrive as a proposal with the reason, cost impact, and rollback plan. Nothing is applied until you approve it. Automatic rollbacks on failed health checks are the one exception, and they only revert to your last approved state.
- 07
Revoke access any time
Delete the role (or its CloudFormation stack) and our access ends immediately. Your infrastructure keeps running, and the code is already in your repo.
Other clouds
Same principles everywhere: scoped, short-lived where the provider supports it, logged in your account, and revocable by you.
Azure
A service principal with a role assignment scoped to a dedicated resource group, authenticated with workload identity federation instead of client secrets.
GCP
A service account with predefined roles on a dedicated project, accessed through workload identity federation, so no service account keys are issued.
DigitalOcean
A custom-scoped API token limited to the resources we manage, with an expiry date you set. Revoke it from your control panel at any time.
Your data stays in your account
Databases, files, and logs live in your cloud, in the region you choose. That makes it easier to meet data-residency and privacy requirements such as India's DPDP Act, GDPR, and UK GDPR. We don't copy your production data into our systems.
What we don't claim
We don't hold SOC 2 or ISO 27001 certifications yet. Running in your own account means your provider's compliance programs cover the underlying infrastructure, and we're happy to walk through our controls on a call or fill in your security questionnaire.
Early access: working with the first 10 teams
Have a security questionnaire?
Bring it to the call. We'll go through the access model line by line.