Platform security
CloudQuell holds sensitive cloud-billing data, so security is built into the platform. This page summarizes the protections that apply across the product. For the agent-specific guarantees of the MCP server — token scopes, double-gated writes, and prompt-injection guidance — see Security & privacy.
Read-only access to your cloud
Section titled “Read-only access to your cloud”CloudQuell reads your AWS environment through a cross-account IAM role you configure, with only the read-only permissions needed to ingest cost and usage data. It cannot modify, launch, or delete resources in your account. Billing line items come from a Cost and Usage Report delivered to an S3 bucket you control. See Connect AWS for how the role is set up.
What CloudQuell does not collect
Section titled “What CloudQuell does not collect”CloudQuell ingests billing and usage metadata only — service codes, resource identifiers, usage types, regions, costs, and the tags you apply. It never collects your application payloads, databases, logs, production traffic, or your own customers’ personal data.
Tenant isolation and encryption
Section titled “Tenant isolation and encryption”Every organization is isolated from every other one. Your identity is derived from your login and mapped to your organization membership server-side — it is never a value a client can set, and every query is scoped to your organization, so there is no path to another tenant’s data. Data is encrypted at rest with AWS-managed encryption — Amazon RDS storage encryption, Amazon S3 (SSE-S3 / AES-256), and DynamoDB server-side encryption — and in transit with TLS. It is stored in AWS data centers in the United States.
Role enforcement
Section titled “Role enforcement”Access is governed by roles, and every write is re-checked against your role on the server for each action. A user who keeps an old session after being demoted still can’t perform actions their new role forbids — the next request returns a clean “permission required” error. The same role checks apply to the MCP server.
Audit logging
Section titled “Audit logging”Requests flow through logged infrastructure, and changes hit audited backend routes — the same routes the dashboard uses — tied to your identity. If you need a specific audit trail for activity in your organization, contact CloudQuell support.
Reporting a security issue
Section titled “Reporting a security issue”Found a vulnerability? Contact CloudQuell security or support directly rather than filing it in a public tracker, and never include live tokens or secrets in a report.