Cloud Decoded is SOC 2-ready by design, not retrofitted — per-tenant isolation, sanitization, and audit logging were built in from the first line of code, not added after a customer asked. This page states plainly what that means. If you need more than this page covers, the security questionnaire response is one email away.
SOC 2 readiness describes the architecture and controls in place. It is not a claim of a completed SOC 2 Type I or Type II attestation — ask us directly about current attestation status.
Every capability stops at a hard approval step before any proposed fix executes against your infrastructure. This isn’t a setting you can turn off; it’s how the platform is built. Detection and diagnosis are automatic. Action never happens without your team.
Every table is scoped by workspace, with row-level security enforced at the Postgres layer — not just application logic. A query without a workspace scope fails closed, not open. One customer’s data is never reachable from another’s workspace, by construction.
Every piece of text used for diagnosis — log excerpts, config content, PR diffs — passes through a redaction layer first: API keys, credentials, and PII patterns are stripped before the data ever leaves your workspace context, regardless of which provider is handling that request.
Every run — created, approved, rejected, held, or resolved manually — is written to your own per-tenant audit record: actor, action, resource, outcome, and timestamp. Nothing is deleted from it, and it’s scoped to your workspace the same way every other table is — queryable by you, not just visible in a dashboard summary. If a fix was proposed, you can see exactly what it proposed and what happened to that proposal.
AWS access is a cross-account role assumed with an external ID — never a stored access key. Azure access is a Service Principal you create and can revoke at any time. GitHub access is a real GitHub App installation with fine-grained, revocable permissions — not a personal access token tied to one person’s account. Every AWS action and Azure action any agent can take is published, per-agent, read vs. write — not described in general terms. A Read-Only mode is available per AWS/Azure connection: no write API call is ever attempted, regardless of what you approve.
Every execution has a hard spend cap and a call-count limit. If a run exceeds either, it stops — it doesn’t retry, and it doesn’t silently keep going. Runaway cost or a stuck loop can’t turn into a surprise bill or an unbounded action.
For a formal security review, architecture diagram, or DPA — email us and we’ll send the full package.