Security Policy

Version 3.1 — Reflects Agentic tier write-access capabilities and infrastructure security posture

1. Security Overview

CloudWise implements defense-in-depth security across all layers. We follow the principle of least privilege and enforce strict access controls, especially for write-access remediation features.

• Least Privilege: Every IAM role and service has minimum required permissions
• Zero Trust: All service-to-service calls are authenticated and authorized
• Defense in Depth: IAM, allow-lists, approval workflows, and audit trails
• Transparency: Complete audit trail for every action

2. Data Access and Permissions

2.1 Read-Only Access (All Tiers)

CloudWise accesses the following via the CloudWiseCostAccessRole IAM role:

• AWS Cost Explorer API data (costs, usage, forecasts)
• Billing and usage information
• Resource metadata (IDs, types, tags, states) for waste detection
• Account metadata (account ID, regions)

2.2 Write Access (Agentic & Compliance Tiers Only)

For customers who opt in, CloudWise uses the CloudWiseRemediationRole to execute approved actions:

All write actions require explicit customer approval before execution.

2.3 What CloudWise Does NOT Access

2.4 Action Allow-List

All remediation actions are restricted to a hardcoded allow-list. The allow-list covers ~20 services with curated safe operations. Any API call not in the allow-list is blocked at the code level, regardless of IAM permissions.

3. Remediation Security Architecture

3.1 Approval Workflow

Every remediation action follows a strict lifecycle:

1. AI Recommendation → Action proposed with risk level and estimated savings
2. Pending Review → Customer reviews details (72-hour expiry)
3. Customer Approval → Explicit authorization via dashboard, email, Slack, or API
4. Execution → Action performed with fresh short-lived credentials
5. Result → Success/failure logged to audit trail; notification sent

High-risk actions require MFA confirmation. No action is ever executed without explicit approval.

3.2 Credential Isolation

3.3 Execution Safeguards

• Allow-list enforcement: Double-checked at plan time and execution time
• Resource verification: Resource existence and state verified before execution
• Dry-run where possible: AWS dry-run API used before actual execution
• Caller identity verification: STS GetCallerIdentity validated
• Timeout limits: 15-minute maximum execution window
• One-click rollback: You can roll back a completed action for 24 hours. Nothing is rolled back automatically: if an action fails partway, every snapshot or backup it created is listed for you

3.4 Audit Trail

Every remediation action generates an immutable audit record containing action details, approver, timestamps, execution results, and rollback records. Audit records are retained for 7 years.

4. Data Security

• Data in Transit: TLS 1.2+ for all communications (HTTPS only)
• Data at Rest: AES-256 encryption via AWS KMS for DynamoDB and S3
• No Access Keys: CloudWise never stores AWS access keys or secrets
• API Authentication: JWT tokens with expiration for user sessions

5. Infrastructure Security

5.1 Application Services

5.2 Security Monitoring & Compliance

CloudWise's own AWS account is continuously monitored by multiple security services:

5.3 Account Hardening

• S3 Account Public Access Block: All public access blocked at the account level — no bucket can be made public
• EBS Default Encryption: All new volumes encrypted automatically using AWS KMS
• IAM Password Policy: 14-character minimum, complexity requirements, 90-day rotation
• OIDC CI/CD: GitHub Actions authenticate via OpenID Connect — no static credentials in CI/CD pipelines

6. Slack Integration Security

• Outbound webhooks validated to match https://hooks.slack.com/
• Inbound interactions verified via HMAC-SHA256 signature validation
• Replay protection: requests older than 5 minutes are rejected
• Slack user mapped to CloudWise user before any action is taken

7. Incident Response

• 24/7 automated monitoring via CloudWatch alarms
• Customer notification within 24 hours for data incidents
• Emergency Stop: All pending approvals can be frozen globally; the CloudWiseRemediationRole can be revoked by you at any time

8. Your Security Responsibilities

• Enable MFA on AWS root and IAM accounts
• Regularly review IAM roles and permissions granted to CloudWise
• Monitor AWS CloudTrail for CloudWise API activity
• Configure resource exclusions to protect critical infrastructure
• Maintain independent backups of critical resources
• Remove CloudWise IAM roles if you cancel your subscription

9. Compliance

15331269 CANADA INC. implements controls aligned with:

• SOC 2 Type II principles (Security, Availability, Confidentiality)
• PIPEDA (Personal Information Protection and Electronic Documents Act)
• AWS Well-Architected Framework security pillar

All data processed and stored in AWS us-east-1 (N. Virginia, United States).

10. Contact Us

Security inquiries: security@cloudcostwise.io (within 24 hours)
Critical incidents: security@cloudcostwise.io — subject "URGENT" (within 4 hours)
Privacy: privacy@cloudcostwise.io
General: support@cloudcostwise.io