Security
What protects your cloud accounts, the changes made on them and your team's sign-in: the rules CloudOps Move2Cloud holds to, on one page for a security review.
Security and Permissions
Move2Cloud follows the Principle of Least Privilege: the assistant can do what the access you created allows, and nothing more; nothing changes in an account before someone allowed to confirms it.
Your cloud accounts
- Each account is connected with an access you create and keep the control of: read only, or with the changes you allow.
- No master key: AWS through a role created by CloudFormation, Azure through an application you authorise, Google Cloud through a service account you give roles to.
- The credentials you give (OVHcloud, Scalingo, Scaleway, or a key of your own) are checked, then encrypted in the database, and never shown again.
- Removing the access at the provider cuts it at once; removing the account here deletes its credentials.
Changes
- Every change is first shown as a plan, with its steps and its risk; nothing runs before it is confirmed, and the result is read back from the account.
- A read-only member can ask questions but no change is prepared or run for them; an operator prepares and runs changes; an administrator also manages the team and its cloud accounts.
- An administrator can require their approval before an operator's change runs, for every change or only for deletions.
- An approved change runs exactly the plan the administrator examined, once: a plan that changed in the meantime is refused, and a request left without an answer expires after 24 hours, without running.
- Every change run is kept in the journal, with who asked, who confirmed it and what happened.
Sign-in and team
- Passwords of at least 12 characters; repeated failed attempts lock the sign-in for a while.
- Two-step sign-in, mandatory for every user: an authenticator app paired at the first sign-in, also asked when you sign in with Google or Microsoft.
- Signed out after 10 minutes without activity; the browsers signed in to the console are listed in My Account → Security, and signed out of it from there.
- Handing an organisation over, cancelling the subscription or deleting an account asks for a sign-in less than 10 minutes old: if needed, the password is asked again, without signing out.
- A cloud account is shared with the whole team or kept for administrators; conversations stay personal.
- Exchanges are encrypted (HTTPS). The administration of the platform shows neither your credentials nor the content of your conversations.
Plans and confirmation
On a cloud account, a wrong command can stop a service or delete data. That is why the assistant never changes anything straight away: a change you ask for is first written as a plan, which shows:
- The steps, in the order they will run, with the exact commands.
- The risk, from low to high, and what a step may interrupt.
- What has to be confirmed before it runs.
Nothing has changed until the plan is confirmed; cancelling it leaves the account as it was. Once it has run, the assistant reads the account again and tells you what really happened: a step that failed is reported, not hidden.
Roles and approvals
Not everyone in a team needs the same rights. Giving each person only what their work requires, the principle of least privilege, limits what a mistake or a stolen account can do.
- Read-only: asks questions; no change is prepared or run for them.
- Operator: prepares and runs changes.
- Administrator: also manages the team, the cloud accounts and the rules.
For the changes that matter most, a second pair of eyes helps: an administrator can require their approval before an operator's change runs, for every change or only for deletions. The change waits, with its plan and its risk, until an administrator approves it or refuses it with a reason.
The journal and audits
Knowing who changed what, when and why is the first thing an incident review, a security audit or a compliance check asks for.
CloudOps Move2Cloud keeps the journal of the organisation: every change run, the account it ran on, who asked for it, who confirmed or approved it, and the report of what happened. Administrators also see a summary of the activity by account and by member.
The journal exports as CSV, for a spreadsheet, or as PDF, for an audit file.
Sovereignty
A sovereign application
CloudOps Move2Cloud and its data are hosted in France, with French and European providers.
Application and data in France
The console, its services, the databases and their backups run at Scalingo, a French host, in its Paris region. Sign-in is handled by Move2Cloud's own identity service, hosted there too.
Files and e-mails in France
The files and images attached to conversations are stored at Scaleway, in Paris, and the e-mails of the service are sent from there.
Invoicing and payment in Europe
Invoices are issued in France and payments are handled by a European provider. Move2Cloud keeps neither card number nor IBAN.
On the public clouds, only what connects your account
For a client on AWS, Move2Cloud keeps on AWS only the CloudFormation template that creates the role, and the technical identity that uses it. For Azure, only the application you authorise in your directory. For Google Cloud, in its own project, the service account you give roles to. No client data is stored on these clouds.