Security at CloudYali
This page answers the questions a security review usually asks: how CloudYali reaches your providers, how your data is protected, how people sign in, and how long data is kept. To report a security issue, email security@cloudyali.io.
How CloudYali connects to your providers
| Provider | What you give CloudYali | Exact permissions |
|---|---|---|
| AWS | An IAM role in your account, created by a CloudFormation stack. CloudYali assumes it with an external ID; no access keys are shared | AWS permissions |
| Google Cloud | A service account key you create | Google Cloud permissions |
| Azure | A service principal (app registration) with a client secret | Azure permissions |
| Anthropic, OpenAI, Cursor, Fastly | An API key you create | Each provider's page under Integrations |
Encryption
- In transit. Traffic between your browser and CloudYali, and between CloudYali and your providers, is encrypted with TLS (HTTPS).
- At rest. Data CloudYali stores is encrypted at rest.
- Credentials. API keys for Anthropic, OpenAI, Cursor and Fastly, and Microsoft Azure and Databricks credentials, are stored in AWS Secrets Manager.
Where your data is stored
CloudYali runs on AWS, and stores your data in the US East (N. Virginia) region (us-east-1).
Sign-in and access
- You sign in with your email address and password. Single sign-on (SSO) is not available.
- Two-factor authentication (MFA) is not available yet.
- Each request is tied to your organization from your verified sign-in, so you see your organization's data only.
- Everyone in your organization sees all of its data. Roles change what the console shows; see Users and roles.
- Removing a person from User Management deletes their sign-in.
Retention and deletion
- Billing data is kept for 12 months.
- Removing a connection on the Integrations page does not delete the data already collected, except for Cursor, whose data is deleted with the connection.
- To delete your organization's data, email support@cloudyali.io.
- CloudYali does not sell your data.
Certifications
CloudYali is working toward SOC 2.
Report a security issue
Email security@cloudyali.io. CloudYali reviews every report. There is no bug bounty program.
Related
Was this page helpful?