What Cloudivence reads, and why

Cloudivence makes no change in Azure. Its collectors send read requests and queries only: no write, delete or action calls, no storage account keys, no shared access signatures. It does not read what is inside your storage accounts: two optional features that look at container and file names stay off unless you switch them on.

Azure Resource Graph

Resources, their type, SKU, tags and selected configuration properties, plus subscriptions and resource groups.

Cost Management

Cost per subscription, resource group, meter and day.

Microsoft Defender for Cloud

Recommendation status and severity, secure score.

Azure Policy

Compliance state per resource and assignment.

Role assignments

Scope, role and principal of each assignment, with the principal's display name and sign-in name from Microsoft Graph.

Activity log

Management operations over 90 days, including who performed them.

Azure Monitor metrics

Storage and virtual machine usage metrics.

Network and storage configuration

Firewall, WAF and network security group rules. Storage account settings such as public access and soft delete. Never the data inside the accounts.

Backup and Advisor

Backup protection state and jobs, Azure Advisor recommendations, reservations and their use.

Log Analytics (only if you name a workspace)

Firewall and WAF log entries, which include IP addresses.

Some of this is personal data: the people who performed operations, the names of principals holding roles, and IP addresses in firewall and WAF logs. GenioCT processes it on your behalf, under a data processing agreement signed before any customer data is read.

The read access, the subscriptions in scope, where the pilot data is processed, how long it is kept and what happens to it when the pilot ends are agreed in writing before the pilot starts.

• An administrator approves the Cloudivence application in Microsoft Entra ID. That consent covers directory reads only. It gives no access to subscriptions.
• Access to subscriptions comes from Azure roles you assign: Reader on a management group or on selected subscriptions, optionally Reservations Reader for commitments. Nothing broader.
• A check shows, per subscription, what Cloudivence can and cannot see. Whatever it cannot see is reported as unknown.
• Cloudivence holds no password and no user token of yours. You revoke access by removing the role assignments or the application.

The hosting region, encryption, backup and retention terms for self-service will be published here before self-service opens. Until then they are stated in each pilot agreement. We prefer to leave this empty than to write something we have not built.

This website

cloudivence.com is a static website served through Amazon CloudFront. It sets no cookies and counts visits with Umami on GenioCT's own server, which stores no IP address and identifies no visitor. The pilot request form sends its fields by email through Amazon Web Services in the EU (Ireland). This is separate from where Cloudivence processes customer assessment data. See the privacy notice.

Reporting a security issue

Write to security@cloudivence.com. We answer every report.