Skip to main content
Security questions are common during vendor evaluation and procurement. This page answers the most frequent ones. For full details on certifications, controls, and third-party audits, visit the Cloud Capital Trust Center.

​
What Cloud Capital accesses — and what it does not

Cloud Capital reads your cloud cost and usage data only. We do not access your cloud infrastructure, workloads, customer data, or any resources running in your AWS accounts or GCP projects.

​
How AWS access is granted

Cloud Capital connects to your AWS environment using AWS’s standard cross-account IAM role pattern. Both roles are provisioned via CloudFormation templates that Cloud Capital provides — parameters are pre-populated, so no manual configuration is required. For teams that manage infrastructure exclusively through Terraform, Cloud Capital can provide an equivalent Terraform module. Contact your Cloud Capital representative or support@cloudcapital.co to request it. You retain ownership of the role and can revoke access at any time by deleting the CloudFormation stack (or destroying the Terraform resource). Two separate roles are used, each scoped to its function. Full setup instructions, including how to deploy each CloudFormation stack, are in the Integrate AWS Data guide.

​
Forecasting role (all customers)

A read-only role applied to your AWS management or payer account. It grants access to:
  • Your CUR S3 bucket (scoped to that specific bucket only)
  • AWS billing, Cost Explorer, and pricing APIs
  • Organization account enumeration
  • Resource descriptions (EC2, RDS, ElastiCache, Redshift, OpenSearch) for cost mapping
This role cannot create, modify, or delete any AWS resource.

​
Optimization role (commitment customers only)

A purchasing role applied exclusively to a dedicated, empty AWS account you create for this purpose — never to your management account or any workload account. See Commitment Proposal & Onboarding for how Cloud Capital uses this access to manage your commitments. It grants access to:
  • Purchasing Savings Plans and Reserved Instances on your behalf
  • Creating service-linked roles required by AWS during first purchase
  • Managing service quota increases when needed
This role has no read access to your cost data and no access to any workload accounts.
Both roles use an ExternalId condition in the trust policy — a system-generated UUID unique to your organization. This means only Cloud Capital’s specific AWS account can assume the role, and only when presenting the correct ExternalId. This prevents confused deputy attacks. You can review the full policy in each CloudFormation template: Forecasting template · Optimization template.

​
How GCP access is granted

Cloud Capital connects to your GCP environment using a service account unique to your environment, granted read-only access through four scoped IAM and BigQuery grants. There is no CloudFormation-equivalent stack — each grant is applied directly via gcloud and bq commands (or an equivalent Terraform configuration, for teams that manage infrastructure that way). Full setup instructions are in the Integrate GCP Data guide.

​
Forecasting role (GCP, Beta)

The service account is granted:
  • roles/billing.viewer on your billing account — contract pricing, credits, anomalies, and Google’s own commitment recommendations
  • roles/compute.viewer on your organization (or folder/project) — resource-based Compute commitments
  • roles/bigquery.dataViewer on your billing export table — cost and usage data
  • READER (dataset ACL) on your CUD subscriptions dataset — spend-based commitment data
This service account cannot create, modify, or delete any GCP resource — all four grants are strictly read-only.
GCP’s IAM model doesn’t need an ExternalId-style condition: each grant is scoped to a service account email unique to your environment, rather than to a whole AWS-style account. There is no equivalent “confused deputy” risk to mitigate, since the grant already names the exact principal rather than an entire account. See Integrate GCP Data for the exact grant commands and the service account email format.
Commitment purchasing and billing through Cloud Capital are not yet available for GCP (Beta). The GCP integration currently supports cost forecasting, cost insights, cost allocation, and commitment inventory/performance visibility only — there is no GCP equivalent of the AWS Optimization role today. See Integrate GCP Data for the current feature scope.

​
Revoking access

AWS: You can revoke either role at any time by deleting the corresponding CloudFormation stack in your AWS console. Access is terminated immediately. GCP: You can revoke access at any time by removing the IAM and dataset-ACL grants described above from your GCP environment. Access is terminated immediately once the grants are removed.
For commitment customers, revoking the AWS Optimization role removes Cloud Capital’s ability to manage your commitments and fulfill its contractual obligations. Contact your Cloud Capital representative before revoking if you have active commitments in place.

​
Data protection

In transit: All communication between Cloud Capital and your cloud provider (AWS or GCP) is encrypted with TLS. At rest: All data stored in Cloud Capital is encrypted using AWS encryption standards, regardless of whether it originated from your AWS or GCP environment — this reflects how Cloud Capital’s own infrastructure is hosted, not your source cloud provider. Retention: Your cost and usage data is stored for the duration of your use of the platform. Upon account deletion, all associated data is deleted within 30 days. You may also request deletion at any time. Third parties: Cloud Capital does not share your cost or usage data with any third party. We use third-party tools for internal purposes (analytics, support, payment processing), but none of those services have access to your cost or usage data.

​
Audit logging

All access to customer data and platform actions are logged. For commitment customers, every commitment decision — including the context and approvals — is recorded in the audit trail. Customers can request logs as part of their compliance requirements.

​
Google Sheets integration

Cloud Capital’s Google Sheets integration lets you import business metrics directly from a spreadsheet into your forecasts. The connection uses Google’s standard OAuth authorization flow. What Cloud Capital can access:
  • Only the specific files you explicitly share with your organization — not your entire Google Drive
  • Each team member who connects their Google account does so independently; their unshared spreadsheets remain private
Visibility and control:
  • All files shared with your organization are listed in Organization Settings → Data Connections → Shared Files, giving you a clear record of what is accessible at all times
  • Any shared file can be revoked from that same settings page at any time
  • Revoking a file immediately breaks the sync for any metrics currently importing from it
Cloud Capital does not store your Google credentials. Access is governed entirely by Google’s OAuth token system and can be revoked from either Cloud Capital’s settings or directly from your Google account’s connected apps.

​
User authentication and SSO

Cloud Capital supports Single Sign-On (SSO) via OIDC, compatible with Google Workspace, Microsoft Entra ID, Okta, Auth0, OneLogin, and other OIDC-compliant identity providers. SSO can be configured as optional or enforced across your organization. See the SSO setup guide for full configuration instructions. The Cloud Capital API uses API key authentication. Keys are scoped to your organization and should be treated as secrets — do not expose them in client-side code, public repositories, or logs.

​
Compliance and certifications

For information on Cloud Capital’s security certifications, SOC 2 status, penetration testing, vendor questionnaire responses, and compliance documentation, visit the Cloud Capital Trust Center. If you have specific security or compliance questions that are not answered there, contact us at support@cloudcapital.co or via your shared Slack channel.