Skip to main content
Security questions are common during vendor evaluation and procurement. This page answers the most frequent ones. For full details on certifications, controls, and third-party audits, visit the Cloud Capital Trust Center.

​
What Cloud Capital accesses — and what it does not

Cloud Capital reads your cloud cost and usage data only. We do not access your cloud infrastructure, workloads, customer data, or any resources running in your AWS accounts.
Cloud Capital accesses thisCloud Capital does not access this
AWS Cost and Usage Reports (CUR)Yes
AWS billing, pricing, and commitment APIsYes
AWS Organizations account structureYes (read-only)
EC2, RDS, and other resource descriptionsYes (read-only, for cost mapping)
Running workloads, application code, databasesNever
Customer or end-user dataNever
IAM credentials or secretsNever

​
How AWS access is granted

Cloud Capital connects to your AWS environment using AWS’s standard cross-account IAM role pattern. Both roles are provisioned via CloudFormation templates that Cloud Capital provides — parameters are pre-populated, so no manual configuration is required. For teams that manage infrastructure exclusively through Terraform, Cloud Capital can provide an equivalent Terraform module. Contact your Cloud Capital representative or support@cloudcapital.co to request it. You retain ownership of the role and can revoke access at any time by deleting the CloudFormation stack (or destroying the Terraform resource). Two separate roles are used, each scoped to its function. Full setup instructions, including how to deploy each CloudFormation stack, are in the Integrate AWS Data guide.

​
Forecasting role (all customers)

A read-only role applied to your AWS management or payer account. It grants access to:
  • Your CUR S3 bucket (scoped to that specific bucket only)
  • AWS billing, Cost Explorer, and pricing APIs
  • Organization account enumeration
  • Resource descriptions (EC2, RDS, ElastiCache, Redshift, OpenSearch) for cost mapping
This role cannot create, modify, or delete any AWS resource.

​
Optimization role (commitment customers only)

A purchasing role applied exclusively to a dedicated, empty AWS account you create for this purpose — never to your management account or any workload account. See Commitment Proposal & Onboarding for how Cloud Capital uses this access to manage your commitments. It grants access to:
  • Purchasing Savings Plans and Reserved Instances on your behalf
  • Creating service-linked roles required by AWS during first purchase
  • Managing service quota increases when needed
This role has no read access to your cost data and no access to any workload accounts.
Both roles use an ExternalId condition in the trust policy — a system-generated UUID unique to your organization. This means only Cloud Capital’s specific AWS account can assume the role, and only when presenting the correct ExternalId. This prevents confused deputy attacks. You can review the full policy in each CloudFormation template: Forecasting template · Optimization template.

​
Revoking access

You can revoke either role at any time by deleting the corresponding CloudFormation stack in your AWS console. Access is terminated immediately.
For commitment customers, revoking the Optimization role removes Cloud Capital’s ability to manage your commitments and fulfill its contractual obligations. Contact your Cloud Capital representative before revoking if you have active commitments in place.

​
Data protection

In transit: All communication between Cloud Capital and AWS is encrypted with TLS. At rest: All data stored in Cloud Capital is encrypted using AWS encryption standards. Retention: Your cost and usage data is stored for the duration of your use of the platform. Upon account deletion, all associated data is deleted within 30 days. You may also request deletion at any time. Third parties: Cloud Capital does not share your cost or usage data with any third party. We use third-party tools for internal purposes (analytics, support, payment processing), but none of those services have access to your cost or usage data.

​
Audit logging

All access to customer data and platform actions are logged. For commitment customers, every commitment decision — including the context and approvals — is recorded in the audit trail. Customers can request logs as part of their compliance requirements.

​
Google Sheets integration

Cloud Capital’s Google Sheets integration lets you import business metrics directly from a spreadsheet into your forecasts. The connection uses Google’s standard OAuth authorization flow. What Cloud Capital can access:
  • Only the specific files you explicitly share with your organization — not your entire Google Drive
  • Each team member who connects their Google account does so independently; their unshared spreadsheets remain private
Visibility and control:
  • All files shared with your organization are listed in Organization Settings → Data Connections → Shared Files, giving you a clear record of what is accessible at all times
  • Any shared file can be revoked from that same settings page at any time
  • Revoking a file immediately breaks the sync for any metrics currently importing from it
Cloud Capital does not store your Google credentials. Access is governed entirely by Google’s OAuth token system and can be revoked from either Cloud Capital’s settings or directly from your Google account’s connected apps.

​
User authentication and SSO

Cloud Capital supports Single Sign-On (SSO) via OIDC, compatible with Google Workspace, Microsoft Entra ID, Okta, Auth0, OneLogin, and other OIDC-compliant identity providers. SSO can be configured as optional or enforced across your organization. See the SSO setup guide for full configuration instructions. The Cloud Capital API uses API key authentication. Keys are scoped to your organization and should be treated as secrets — do not expose them in client-side code, public repositories, or logs.

​
Compliance and certifications

For information on Cloud Capital’s security certifications, SOC 2 status, penetration testing, vendor questionnaire responses, and compliance documentation, visit the Cloud Capital Trust Center. If you have specific security or compliance questions that are not answered there, contact us at support@cloudcapital.co or via your shared Slack channel.