Self-Hosted
Runs in your Azure subscription. Your data stays in your own database.
Read-Only Scanning
Scanning reads metadata only: names, expiry dates, properties. Never secret values.
Not Another Vault
Works with your existing Key Vaults. It doesn't replace them.
Key principle: CertifyClouds stores your operational data in YOUR Azure environment. Our services receive licence validation and bounded aggregate fleet-health counters, never secret values or credential metadata. Optional integrations connect only to destinations your administrator approves.
Deployment Architecture
CertifyClouds deploys as a Docker container in your Azure subscription, with all data stored in your own PostgreSQL database.
Data Handling
We See
- Your licence key (for validation)
- Your licence tier and features
- Version check requests
- Aggregate operational counts, unless you turn them off
Never Sent To CertifyClouds
- Your secret values*
- Your scan results
- Your Azure credentials
- Your database contents
- Your AWS/GCP credentials (Automation Sync)
*During rotation, new credentials are generated through Azure APIs and written to your Key Vaults, the resources that use them and any AWS or GCP copies you configure, over TLS using Managed Identity. CertifyClouds never stores a value in its own database or sends one to us.
Optional hosted AI access: The ENTERPRISE MCP Connector is disabled by default. When your administrator enables it, approved read-only result metadata is sent over TLS to the hosted AI provider you select. CertifyClouds services do not receive those results, and MCP never returns bearer tokens, secret values, private keys, or certificate material. Review the MCP security boundary →
Authentication
CertifyClouds uses Azure Managed Identity - no credentials are stored in the container or configuration files.
How It Works
- User-Assigned Managed Identity: Created during deployment, attached to your container
- Azure RBAC: Identity is granted specific roles on Key Vaults and subscriptions
- Token-based: Microsoft Entra ID issues short-lived tokens automatically
- No secrets in config: No service principal passwords or certificates in config
- Connected tenants: B2C and External ID tenants, and on Enterprise your other Entra tenants, sign in with a service principal secret stored encrypted in your database. CertifyClouds warns your admins before these secrets, or its SSO client secret, expire.
Settings → Access (admins only) lists every identity CertifyClouds signs in with, its Microsoft Graph permissions and its Azure access down to each subscription and vault. Refresh Permissions reads them again after you change a grant, and Test Connection checks that the identity can still sign in and reach Azure.
Application Security
CertifyClouds includes built-in defences against brute-force and session hijacking attacks. All values are configurable via environment variables:
- Account lockout: Configurable threshold and duration after repeated failed sign-ins
- Session management: Configurable maximum session duration and idle timeout
- Sign-in rate limiting: Per-IP rate limit on sign-in attempts
- HttpOnly cookies: Auth tokens not accessible to JavaScript, preventing XSS token theft
- Secure cookies: HTTPS-only transmission
Permission Matrix
CertifyClouds requests only the minimum permissions needed for each feature.
| Permission | Scope | Purpose | Required For |
|---|---|---|---|
Reader | Subscription | List Key Vaults and resources, including the certificates your Azure services serve on custom domains | All features |
Key Vault Reader | Per Key Vault | Read vault metadata and properties | Key Vault Scan |
Key Vault Secrets User | Per Key Vault | Read a certificate's backing secret (PFX) during rotation | Automation Rotation (Pro) |
Key Vault Secrets Officer | Per Key Vault | Create and update secrets | Automation Rotation (Pro) |
Key Vault Certificates Officer | Per Key Vault | Create and update certificates | Automation Rotation (Pro) |
Application.Read.All | Graph API (Tenant) | Read App Registration credential metadata (read-only) | App Registration Discovery (Starter) |
Application.ReadWrite.All | Graph API (Tenant) | Rotate App Registration secrets | Automation Rotation (Pro) |
Policy.Read.All | Graph API (Tenant) | Read your tenant's app management policy (optional) | App management policy checks (Starter) |
Important: The Key Vault Scan uses read-only permissions - the application reads secret metadata (names, expiry dates) but never the actual secret values. Automation Rotation in Pro and Enterprise generates new credentials through Azure APIs and writes them to your Key Vaults and the resources that use them. CertifyClouds holds secret values in memory only while it does this, never stores them in its own database and never sends them to us.
This lists the core least-privilege roles. For the complete, authoritative permission reference (including key rotation, full-stack rotation, SSO, and B2C tenant scanning), see the Azure permissions guide in our documentation.
Encryption
Data at Rest
- Database: Azure PostgreSQL Flexible Server with encryption at rest (Azure-managed keys)
- AWS/GCP Credentials (Automation Sync): Encrypted at rest using your application secret before being stored
Data in Transit
- Azure APIs: TLS 1.2+ (enforced by Azure)
- Database: TLS connection (enforced by Azure PostgreSQL)
- Licence Server: HTTPS/TLS 1.3
Network Security
- No public IP: Container Apps/ACI deployed with internal-only ingress
- VNet integrated: Application runs in your VNet subnet
- Private endpoints: Supported for Key Vault and PostgreSQL
- Firewall compatible: Setup script adds subnet to Key Vault firewall rules
- Optional MCP ingress: Expose only the connector paths when a hosted client is enabled
Outbound Connections
CertifyClouds makes these outbound calls:
| Destination | Purpose | Frequency |
|---|---|---|
license.certifyclouds.com | Licence validation | At startup and regularly while running |
management.azure.com | Azure Resource Manager API | During scans/operations |
*.vault.azure.net | Key Vault data plane | During scans/rotations |
graph.microsoft.com | App Registration discovery and rotation | During scans/rotations |
| Certificate authority addresses named in your certificates (HTTP) | Download a CA-issued certificate's intermediates to check its chain | During scans (can be turned off in Settings) |
secretsmanager.*.amazonaws.com | AWS Secrets Manager | Automation Sync only |
secretmanager.googleapis.com | GCP Secret Manager | Automation Sync only |
Compliance Support
CertifyClouds helps organisations gather evidence for credential-lifecycle controls across multiple frameworks:
- Audit logging: Every action is logged with timestamp, actor, and details
- Compliance scoring: Pre-built rules aligned with industry standards
- Exportable evidence packages: Auditor-ready bundles (CSV data plus PDF wrapper with customer management assertion) for the CIS Azure Foundations Benchmark, SOC 2, ISO 27001, NIST 800-53, Microsoft cloud security benchmark, HIPAA and PCI DSS
- Secret rotation: Automated rotation helps meet credential lifecycle requirements
Important: CertifyClouds is an evidence aggregator for Azure credential-lifecycle controls. We are not a certified compliance product. We do not hold SOC 2, ISO 27001, HIPAA, or PCI DSS certification, and we are not a Business Associate under HIPAA (we do not require, accept, or process PHI). The framework mappings we provide identify what violates each control and recommend customer-side remediation. Your overall compliance depends on your Azure tenant configuration, your processes, and audits performed by your own auditors. Full compliance disclaimer →
Licence Server
The licence server validates your licence key and returns your entitlements.
What Happens
- Your container sends your licence key (for example
CC-XXXXXXXX-XXXXXXXX-XXXXXXXX) and current version - Server returns: tier, features, expiry date
- If Share operational counts with licensing is on (the default; turn it off in Settings → Advanced → App behaviour), the hourly licence check also carries aggregate operational counts: total vault, secret, cert and key counts, rotation success-rate, and feature-adoption counts. No asset names, no PII, no compliance findings, no customer data. See the Privacy Policy, Aggregate Operational Counts for the complete list and the opt-out path.
Offline Operation
- The licence is cached locally after successful validation
- If the licence server is temporarily unreachable, the cached licence is used for a configurable grace period (7 days by default)
- Once the grace period ends, access is blocked until CertifyClouds can reach the licence server again
Security Questions?
If you have security questions or need additional documentation for your security review, contact us at [email protected].