| title | description |
|---|---|
Security |
As an infrastructure tool that requires access to your cloud provider, we understand there may be questions, concerns, and necessary clarification around our infrastructure, processes, and procedures. We, as developers at Vantage, are also customers of Vantage, which more closely aligns our security concerns with those of our customers. |
Vantage uses read-only service accounts, service roles, API keys, and other read-only means to access billing data across all the integrations we use. This means we don't store sensitive information, like account access keys and access key secrets, to use Vantage. Should you have any other questions, please feel free to email us at [email protected].
Vantage uses a Cross-Account IAM Role to sync information about your infrastructure resources. This method is the AWS-recommended approach. When you grant Vantage access to your account by running the provided CloudFormation stack, the stack creates a cross-account role with in-line policies selected by Vantage. These policies are a trimmed-down version of the policies in the AWS-managed ReadOnlyAccess policy, but we've removed actions that would otherwise allow us to access sensitive information in databases, buckets, and certain services. Our CloudFormation template is open source and hosted publicly for transparency.
Vantage requests various in-line read-only permissions when creating the cross-account role on your behalf; however, we understand this can be too broad of a permission set for certain use cases. As a result, we do allow you to create Cross-Account IAM roles with whatever permissions you're comfortable with. However, keep in mind that narrowing the scope of the role's permissions will limit certain functionality in Vantage.
If you email [email protected] in advance, we can facilitate provisioning your account with a custom role. Please note that we will provide you with some custom attributes to associate with your Cross-Account IAM Role to prevent the "confused deputy" problem. As a result, you will need to contact Vantage support before you create the role.
In the account Settings section, you can revoke the Cross-Account IAM Role at any time. Automatically and nearly instantly, Vantage will delete all data associated with that Cross-Account IAM Role. Note that the deletion doesn't remove the set of custom Vantage views you've created; however, these views will be empty, as there are no longer any resources.
In the account Settings section, you also can delete your account. Once you delete your account, all data is deleted as well.
We do not share any data externally. We do not sell or share any user data with any third parties.
<Accordion title="Does Vantage periodically perform penetration tests?"
Yes. Vantage has outsourced penetration tests to a third party that regularly performs these tests.