AWS Access & Security

1. Our principles

• No root credentials, passwords or long-term access keys. KloudCare never asks for them.
• Read-only by default. Reviews use a read-only role. Nothing is changed without your approval.
• You stay in control. You create every role yourself, can see every action we take, and can remove our access at any time.
• Minimum data. We collect only what the work needs, keep it encrypted and delete it on a fixed schedule.

2. The free assessment

• The free assessment runs entirely in your own AWS account. KloudCare has no access to it.
• It is read-only: it cannot change, stop or delete anything, and it never reads your files, database contents or secrets.
• The report is saved to a private, encrypted S3 bucket in your account and deleted automatically after 30 days by default. Nothing is sent to KloudCare unless you choose to share the report.
• The CloudFormation template is plain text, so you can review every permission before you deploy it. The assessment code is downloaded from kloudcare.co.uk and verified with a SHA-256 checksum before it runs.
• To remove it, delete the CloudFormation stack. This removes the role, the job, the function, the bucket and all reports.

3. When KloudCare needs access

For a Health Check, AWS Cost Watch or engineering work, access works like this:

Step 1: Approve

• You create the access role yourself from a CloudFormation template. The template is plain text, so you can read every permission before you deploy it.
• The review role is read-only. It cannot change, stop or delete anything, and it cannot read your files, database contents or secrets.
• KloudCare can use the role only with an external ID unique to your organisation, and each session lasts at most one hour.
• Changes never use the read-only role. For an approved change, you either make it with our guidance, or create a separate, time-limited role limited to that change, and remove it afterwards.

Step 2: Monitor

• Every action made through the role is recorded in your own AWS CloudTrail, with the role name and time. In the CloudTrail console, open Event history and filter by the role name to see exactly what was done.
• If CloudTrail is not yet enabled for all regions, we will help you turn it on first. The free assessment checks for this.

Step 3: Revoke

• Delete the CloudFormation stack (or the role) and KloudCare's access ends.
• To end a session that is already in progress straight away, open the role in the IAM console and choose Revoke active sessions before you delete it.
• When an engagement ends, we will remind you to remove the role and confirm when our copies of your data have been deleted.

4. How we handle your data

• We collect configuration, usage metrics and cost data only. The read-only role cannot read your files, database contents or secrets.
• Data is stored encrypted, kept separate from other clients' data, and accessed only by the people working on your engagement.
• Health Check: collected data and working files are deleted 90 days after the findings session. The final report is kept for 12 months for any follow-on work, unless you ask for earlier deletion.
• AWS Cost Watch: reports and change records are kept while the service is active, and for 90 days afterwards.
• We treat everything we learn about your environment as confidential, and do not share it with third parties except subcontractors bound by confidentiality, who we tell you about in advance.
• See our privacy policy for how personal information is handled.

5. How we work securely

• Temporary credentials only, through IAM roles. No long-term access keys.
• No credentials or secrets in source control.
• Least-privilege permissions, limited to the agreed work.
• Changes made in code where possible, tested outside production first, and recorded so you can see what changed and when.
• A documented way to remove our access at the end of every engagement.

6. Reporting a security issue

If you believe you have found a security issue with this website, the assessment tool or our services, please email hello@kloudcare.co.uk with the details, including how to reproduce it. Please do not access or change data that is not yours, and give us reasonable time to respond before sharing details publicly. We will acknowledge your report and keep you informed.

7. Contact

For security questions, email hello@kloudcare.co.uk.