Skip to main content
CloudThinker implements enterprise-grade security to protect your cloud infrastructure data and ensure only authorized users can access sensitive operations.

​
Why security matters for an AI operations platform

CloudThinker agents have read (and optionally write) access to your cloud infrastructure. This is powerful — it enables autonomous analysis and optimization across all your cloud accounts. But it also means the platform itself needs to be hardened against unauthorized access, credential leakage, and prompt injection attacks. The security model is designed around these principles:
  • Least-privilege by default: agents use read-only credentials unless write access is explicitly configured and approved
  • Zero persistence: no agent actions modify infrastructure without going through the approval workflow
  • Defense-in-depth: MFA, SSO, RBAC, audit logging, and sandbox isolation combine to protect against both external attacks and internal misuse
  • Transparent: every agent action is logged with the user who initiated it, the approval chain, and the exact command executed

​
Authentication methods

​
Multi-factor authentication (MFA)

Add an extra layer of security with TOTP-based MFA:

​
Enabling MFA

1

Navigate to Security Settings

Go to Profile > Security Settings
2

Enable MFA

Click Enable Multi-Factor Authentication
3

Scan QR Code

Use an authenticator app (Google Authenticator, Authy, 1Password, etc.) to scan the QR code
4

Verify Setup

Enter the 6-digit code from your authenticator to confirm setup
5

Save Backup Codes

Download and securely store your backup codes for account recovery

​
MFA at login

With MFA enabled:
  1. Enter your email and password
  2. Enter the current 6-digit code from your authenticator
  3. Access granted

​
Recovery options

If you lose access to your authenticator:
  • Use a backup code (one-time use)
  • Contact organization admin for MFA reset
  • Contact support with identity verification
Store backup codes securely. Each code can only be used once. If you lose all backup codes and your authenticator, account recovery may require identity verification.

​
Single sign-on (SSO)

Enterprise plans support SSO integration: SSO is configured by Organization Owners in Admin Settings → Identity and access. Key capabilities:
  • Domain verification — prove ownership of your email domain before enabling SSO
  • SAML or OIDC — choose the protocol your identity provider supports
  • SSO enforcement — optionally require all users with a verified domain to authenticate via SSO
  • JIT provisioning — auto-create user accounts on first SSO login
  • SCIM directory sync — automate user and group provisioning from your IdP

​
Configuring SSO

SSO Setup Guide

Step-by-step setup for Google Workspace, Azure AD, AWS IAM Identity Center, Okta, OneLogin, and generic SAML/OIDC

​
SSO enforcement

Organization admins can enforce SSO:
  • Require all users to authenticate via SSO
  • Disable password-based login
  • Auto-provision users on first SSO login
  • Auto-deprovision when removed from IdP

​
Role-based access control (RBAC)

Control what users can do with granular permissions:

​
Organization roles

​
Workspace roles

​
Permission matrix

​
API authentication

Secure programmatic access to CloudThinker:

​
API keys

Generate API keys for automation:
  1. Go to Profile > API Keys
  2. Click Create API Key
  3. Name the key and set expiration
  4. Copy the key (shown only once)
  5. Use in API requests

​
Key management

  • Rotation: Regularly rotate keys (recommended: every 90 days)
  • Scoping: Limit keys to specific operations when possible
  • Monitoring: Review key usage in audit logs
  • Revocation: Immediately revoke compromised keys
Never commit API keys to version control. Use environment variables or secret management tools.

​
OAuth tokens

For integrations that use OAuth:
  • Tokens are automatically refreshed
  • Revoke access from Settings > Connected Apps
  • Monitor token usage in audit logs

​
Data security

​
Encryption

CloudThinker protects your data with:

​
Bring your own key (BYOK)

Enterprise customers can use their own encryption keys:
  1. Configure AWS KMS or similar
  2. Provide key ARN to CloudThinker
  3. Your key encrypts sensitive data
  4. Maintain full key control

Configure BYOK

Set up Bring Your Own Key encryption

​
Data residency

  • Choose data region during workspace creation
  • Data stays within selected region
  • Multi-region options for redundancy

​
Audit logging

Track all activities in CloudThinker:

​
Logged events

  • User authentication (login, logout, MFA)
  • Resource access and modifications
  • Agent conversations and actions
  • Administrative changes
  • API access

​
Viewing audit logs

  1. Navigate to Admin Settings > Organization
  2. Filter by:
    • User
    • Action type
    • Resource
    • Date range
  3. Export logs for compliance

​
Log retention

  • Standard: 90 days
  • Professional: 1 year
  • Enterprise: Configurable (up to 7 years)

​
Security best practices

Require MFA for all organization members, especially those with admin access. Consider enforcing via SSO policies.
Assign the minimum role required for each user’s responsibilities. Review and adjust permissions regularly.
Rotate API keys, refresh tokens, and cloud credentials on a regular schedule.
Regularly review audit logs for suspicious activity. Set up alerts for critical events.
Use read-only credentials when possible. Limit scope to necessary services and regions.
Conduct quarterly access reviews. Remove inactive users and revoke unnecessary permissions.

​
Compliance

CloudThinker maintains compliance with:
  • SOC 2 Type II: Security, availability, and confidentiality
  • GDPR: Data protection for EU users
  • HIPAA: Healthcare data handling (Enterprise)
  • ISO 27001: Information security management

Request Compliance Documents

Contact us for security questionnaires and compliance documentation

Single sign-on

Configure SAML or OIDC SSO with Google Workspace, Azure AD, Okta, and more

SCIM provisioning

Automate user and group sync from your identity provider