You are about to hand us a credential. Here is exactly what happens to it.
This page is written to be forwarded. If your reviewer needs something not here, write to security@hellocloudwatch.com. A person answers.
Where credentials live
Every credential you connect lives in Azure Key Vault, under strict access policies. Nowhere else. Our database holds a reference, never the secret. It holds your account, business-context mappings and the cost figures the agent has read, partitioned per tenant, never beside another customer's. If somebody walked out with a copy of our database, they would not have a single one of your keys.
What each vendor's credential can do
We never change your cloud. Every tool the agent has against your cloud is a read: none resizes a server, stops a deploy or changes an access policy. The one thing it writes is a budget inside hellocloudwatch, and only when you ask. If a vendor only offers a broad key, we keep the same rule.
The table is generated from the vendor registry the product uses. No vendor reaches the product without reaching this page.
| Vendor | Credential scope | How to revoke |
|---|---|---|
| Microsoft Azure | Narrow Scoped to billing. The credential this vendor issues us can read what it costs and nothing else: no resource configuration, no ability to change anything. | Disconnect in your account settings and the secret is deleted from the vault immediately, or delete the credential in the vendor's own console. |
| Google Cloud Platform | Narrow Scoped to billing. The credential this vendor issues us can read what it costs and nothing else: no resource configuration, no ability to change anything. | Disconnect in your account settings and the secret is deleted from the vault immediately, or delete the credential in the vendor's own console. |
| Amazon Web Services | Narrow Scoped to billing. The credential this vendor issues us can read what it costs and nothing else: no resource configuration, no ability to change anything. | Disconnect in your account settings and the secret is deleted from the vault immediately, or delete the credential in the vendor's own console. |
| Cloudflare | Narrow Scoped to billing. The credential this vendor issues us can read what it costs and nothing else: no resource configuration, no ability to change anything. | Disconnect in your account settings and the secret is deleted from the vault immediately, or delete the credential in the vendor's own console. |
| Vercel | Narrow Scoped to billing. The credential this vendor issues us can read what it costs and nothing else: no resource configuration, no ability to change anything. | Disconnect in your account settings and the secret is deleted from the vault immediately, or delete the credential in the vendor's own console. |
| OpenAI | Broad An OpenAI admin key can read and manage your whole organization. We only ever call the costs endpoint, and the key is stored in Azure Key Vault, never in our database. You can revoke it at any time. | Revoke in OpenAI One click there and the key we hold stops working. |
| Anthropic | Broad An Anthropic admin key can read and manage your whole organization. We only ever call the cost report endpoint, and the key is stored in Azure Key Vault, never in our database. You can revoke it at any time. | Revoke in Anthropic One click there and the key we hold stops working. |
| Neon | Narrow Scoped to billing. The credential this vendor issues us can read what it costs and nothing else: no resource configuration, no ability to change anything. | Disconnect in your account settings and the secret is deleted from the vault immediately, or delete the credential in the vendor's own console. |
| Apify | Narrow Scoped to billing. The credential this vendor issues us can read what it costs and nothing else: no resource configuration, no ability to change anything. | Disconnect in your account settings and the secret is deleted from the vault immediately, or delete the credential in the vendor's own console. |
How to revoke, in about a minute
Disconnecting an account in settings deletes the secret from the vault immediately. Not at the end of a cycle, not after a support ticket. Or revoke from the vendor's own console, the column above; the key we hold stops working. Deleting your account purges every stored credential immediately; the privacy notice covers the rest.
Encryption
In transit: TLS 1.2 or later. At rest: Azure Key Vault for secrets, Azure Cosmos DB's service-managed encryption for application data, both in Azure's East US region. We store no card numbers; those stay with Stripe.
Who else touches your data
Each operates under a data-processing agreement. The privacy notice renders this same list from the same source, so the two pages cannot drift apart.
| Provider | Purpose | Region |
|---|---|---|
| Microsoft Azure | Hosting, Cosmos DB, Key Vault, and the Azure OpenAI model the agent reasons with. | USA |
| Firebase (Google) | Authentication, and hosting for this marketing site. | USA |
| Stripe | Payment processing. | USA |
| Postmark | Transactional email: invitations, observation notifications, and account-lifecycle messages. | USA |
| Formspree | Receives contact-form submissions from this marketing site and forwards them to us by email. | USA |
| LogRocket | In-app session replay for debugging. Not used on this marketing site. | USA |
What the model sees, and what it does not
The reasoning step runs on Azure OpenAI. It sees cost and usage figures for connected accounts and the business context you gave it. It never sees your credentials, and has no access to the public internet or to anything outside that cost surface. None of it is used to train models. Microsoft may retain inputs up to 30 days for abuse monitoring under standard Azure OpenAI terms, and does not train on them.
Retention and deletion
Observation journal entries are kept 13 months, so a report can compare a month against the same month last year. Delete your account and credentials go immediately. Everything else enters a 30-day window, hidden from your workspace but restorable, then permanently deleted. A minimal billing record of tenant id, cancellation date and plan, no customer data, survives a further 60 days. Ask us to purge earlier at any time.
What we are not
We are not SOC 2 audited and we hold no ISO 27001 certification. We run on Microsoft Azure, whose certifications are Microsoft's and not ours, and we will not borrow them. What you can verify instead is everything above: credentials stored only in Azure Key Vault and never in our database, the narrowest credential each vendor issues, revocation in about a minute, and every sub-processor named with its purpose and region. When we have a report, this paragraph will say so and you will be able to ask for it.
Reporting something
Write to security@hellocloudwatch.com. The disclosure policy at /.well-known/security.txt (RFC 9116) carries the same address. No bounty programme; we do read every report.