Skip to main content
CloudThinker implements enterprise-grade security to protect your cloud infrastructure data and ensure only authorized users can access sensitive operations.

​
Authentication Methods

Email & Password

Standard authentication with secure password requirements

Multi-Factor Authentication

TOTP-based MFA for additional security

Single Sign-On (SSO)

SAML/OAuth integration with your identity provider

API Keys

Secure programmatic access to the API

​
Multi-Factor Authentication (MFA)

Add an extra layer of security with TOTP-based MFA:

​
Enabling MFA

1

Navigate to Security Settings

Go to Profile > Security Settings
2

Enable MFA

Click Enable Multi-Factor Authentication
3

Scan QR Code

Use an authenticator app (Google Authenticator, Authy, 1Password, etc.) to scan the QR code
4

Verify Setup

Enter the 6-digit code from your authenticator to confirm setup
5

Save Backup Codes

Download and securely store your backup codes for account recovery

​
MFA at Login

With MFA enabled:
  1. Enter your email and password
  2. Enter the current 6-digit code from your authenticator
  3. Access granted

​
Recovery Options

If you lose access to your authenticator:
  • Use a backup code (one-time use)
  • Contact organization admin for MFA reset
  • Contact support with identity verification
Store backup codes securely. Each code can only be used once. If you lose all backup codes and your authenticator, account recovery may require identity verification.

​
Single Sign-On (SSO)

Enterprise plans support SSO integration:

​
Supported Providers

  • Google Workspace: OAuth 2.0 integration
  • Microsoft Azure AD: SAML/OAuth
  • Okta: SAML 2.0
  • OneLogin: SAML 2.0
  • GitHub: OAuth (for developer teams)
  • GitLab: OAuth

​
Configuring SSO

  1. Navigate to Organization Settings > Security > SSO
  2. Select your identity provider
  3. Configure the integration:
    • Enter IdP metadata URL or details
    • Configure attribute mapping
    • Set default role for new users
  4. Test the configuration
  5. Enable SSO enforcement (optional)

​
SSO Enforcement

Organization admins can enforce SSO:
  • Require all users to authenticate via SSO
  • Disable password-based login
  • Auto-provision users on first SSO login
  • Auto-deprovision when removed from IdP

​
Role-Based Access Control (RBAC)

Control what users can do with granular permissions:

​
Organization Roles

RoleDescriptionPermissions
OwnerFull organization controlAll permissions, billing, member management
AdminOrganization administrationManage workspaces, members, settings (no billing)
MemberStandard accessAccess assigned workspaces, use agents
ViewerRead-only accessView dashboards and reports only

​
Workspace Roles

RoleDescriptionPermissions
Workspace AdminFull workspace controlAll workspace operations, member management
EditorStandard operationsRun agents, create recommendations, modify settings
OperatorLimited operationsRun agents, view data, cannot modify settings
ViewerRead-onlyView dashboards, reports, and recommendations

​
Permission Matrix

ActionOwnerAdminEditorOperatorViewer
View dashboardsYesYesYesYesYes
Run agent conversationsYesYesYesYesNo
Create recommendationsYesYesYesNoNo
Approve operationsYesYesYesNoNo
Manage connectionsYesYesYesNoNo
Manage membersYesYesNoNoNo
Organization settingsYesYesNoNoNo
BillingYesNoNoNoNo

​
API Authentication

Secure programmatic access to CloudThinker:

​
API Keys

Generate API keys for automation:
  1. Go to Profile > API Keys
  2. Click Create API Key
  3. Name the key and set expiration
  4. Copy the key (shown only once)
  5. Use in API requests
# Example API request
curl -H "Authorization: Bearer <api_key>" \
  https://api.cloudthinker.io/v1/workspaces

​
Key Management

  • Rotation: Regularly rotate keys (recommended: every 90 days)
  • Scoping: Limit keys to specific operations when possible
  • Monitoring: Review key usage in audit logs
  • Revocation: Immediately revoke compromised keys
Never commit API keys to version control. Use environment variables or secret management tools.

​
OAuth Tokens

For integrations that use OAuth:
  • Tokens are automatically refreshed
  • Revoke access from Settings > Connected Apps
  • Monitor token usage in audit logs

​
Data Security

​
Encryption

CloudThinker protects your data with:
LayerProtection
TransitTLS 1.3 for all connections
At RestAES-256 encryption
SecretsEncrypted credential storage
BackupsEncrypted database backups

​
Bring Your Own Key (BYOK)

Enterprise customers can use their own encryption keys:
  1. Configure AWS KMS or similar
  2. Provide key ARN to CloudThinker
  3. Your key encrypts sensitive data
  4. Maintain full key control

Configure BYOK

Set up Bring Your Own Key encryption

​
Data Residency

  • Choose data region during workspace creation
  • Data stays within selected region
  • Multi-region options for redundancy

​
Audit Logging

Track all activities in CloudThinker:

​
Logged Events

  • User authentication (login, logout, MFA)
  • Resource access and modifications
  • Agent conversations and actions
  • Administrative changes
  • API access

​
Viewing Audit Logs

  1. Navigate to Organization Settings > Audit Log
  2. Filter by:
    • User
    • Action type
    • Resource
    • Date range
  3. Export logs for compliance

​
Log Retention

  • Standard: 90 days
  • Professional: 1 year
  • Enterprise: Configurable (up to 7 years)

​
Security Best Practices

Require MFA for all organization members, especially those with admin access. Consider enforcing via SSO policies.
Assign the minimum role required for each user’s responsibilities. Review and adjust permissions regularly.
Rotate API keys, refresh tokens, and cloud credentials on a regular schedule.
Regularly review audit logs for suspicious activity. Set up alerts for critical events.
Use read-only credentials when possible. Limit scope to necessary services and regions.
Conduct quarterly access reviews. Remove inactive users and revoke unnecessary permissions.

​
Compliance

CloudThinker maintains compliance with:
  • SOC 2 Type II: Security, availability, and confidentiality
  • GDPR: Data protection for EU users
  • HIPAA: Healthcare data handling (Enterprise)
  • ISO 27001: Information security management

Request Compliance Documents

Contact us for security questionnaires and compliance documentation