Security is foundational to a platform that holds credentials to your cloud accounts. This page describes the controls CloudGenie Ltd (Durham, United Kingdom) operates today. It contains no aspirational claims — everything listed here is implemented.

Infrastructure

Hosted on AWS; the API runs on containerised, multi-AZ infrastructure behind a load balancer
TLS 1.2+ enforced everywhere, with HSTS (including subdomains and preload)
Security headers on all product surfaces: Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy
Deployments pass automated post-deploy health gates; a failing release stops the pipeline, not your service

Data protection

Cloud provider credentials are encrypted at rest at the application layer, in addition to storage-level encryption
Strict logical tenant isolation — every record is scoped to your organisation, enforced server-side
We request read-only, least-privilege cloud access; our connection guides ship minimal IAM policies
Verified nightly backups with restore drills and a 30-day retention window

Identity and access

Session cookies are HttpOnly, Secure and SameSite-scoped; sessions are stored and revocable server-side
Role-based access control (viewer / operator / admin / super-admin) with capability checks on every admin route
Brute-force protection: per-IP rate limiting plus automatic account lockout with audit trail
SSO options: Google and Microsoft OAuth; SAML for enterprise plans

Development practices

Automated secret scanning (Gitleaks) on every commit in CI
Code review before merge; immutable, hash-versioned frontend releases
Audit logging of sensitive actions available to tenant admins with CSV export

Compliance posture

CloudGenie provides SOC 2- and HIPAA-aligned technical checks for your cloud environments as a product feature. Regarding our own certifications: we are an early-stage company and do not yet hold third-party certifications. Our roadmap includes an external penetration test and SOC 2 Type I readiness assessment; status updates will be published here. If your procurement process requires our current security questionnaire answers, email security@cloudgenie.co.

Reporting a vulnerability

See our responsible disclosure programme, or check /.well-known/security.txt on any CloudGenie domain. We respond within one working day.