Security

How AZClarity protects your Azure subscription data

Read-only by design. AZClarity is a feature-adoption and visibility tool, not a security or compliance product — it reports on your Azure estate and never modifies it. Need to brief your own security team? A ready-made, copy-paste security brief is in the Help & FAQ under “For your security team.” AZClarity requests only read permissions on your Azure subscription. We cannot create, modify, or delete any Azure resource. This is enforced at the OAuth scope level — not just a policy.

Azure permissions

AZClarity uses Microsoft Entra ID (Azure AD) OAuth with the user_impersonation scope for Azure Resource Manager. This grants read-only access equivalent to the built-in Reader role. The specific permissions used are:

Resource Graph — list resources by type and region
Subscriptions — list subscriptions in your tenant
Cost Management — read spending data (if available)
Security — read Defender for Cloud plan status
Network — read VNet and NSG configuration for security assessment
Authorization — read role assignments (count only, no identity data)

You can revoke AZClarity's access at any time from Microsoft Entra ID → Enterprise applications in the Azure portal. Revoking access immediately invalidates all stored tokens.

Token storage

Azure OAuth access and refresh tokens are encrypted at rest using AES-256-GCM before being written to our database. Each token uses a unique randomly-generated IV. Encryption keys are stored as Cloudflare Worker secrets — separate from the database, never logged.

Tenant isolation

Every database query is scoped to your user ID, derived from your authenticated session token. It is not possible for one customer to access another customer's scan data, subscriptions, or AI results. This is enforced at the query level — not just through UI restrictions.

AI security

When generating AI observations, AZClarity:

Strips all personal data before sending to Anthropic (no email addresses, names, or tokens)
Sanitises resource names to prevent prompt injection attacks
Uses an allowlist of permitted analysis types — no free-text prompt submission from the client
Validates AI output before returning it to ensure no cross-tenant data leakage
Limits AI calls to 10 per user per day to prevent abuse

Infrastructure

Hosting: Cloudflare Workers (edge compute, global network)
Database: Cloudflare D1 — Western Europe region (Amsterdam)
Sessions: Cloudflare KV with 30-day expiry
TLS: Enforced on all connections — HTTPS only, HSTS enabled
DDoS protection: Cloudflare network-level protection

Rate limiting

Authentication: 20 attempts per hour per IP
Scans: 5 per subscription per day
AI calls: 10 per user per day
All API endpoints rate-limited per session

Session security

Sessions use cryptographically random tokens (128-bit entropy)
Sessions expire after 30 days of inactivity
Sessions are immediately invalidated on sign-out
Sessions are invalidated for all team members if an MSP subscription is cancelled

Audit logging

All significant actions are logged to an audit trail: authentication events, scan triggers, AI calls, and admin actions. Audit logs are retained for 12 months. No prompt content is stored in AI audit logs — only metadata (analysis type, token count, timestamp).

Data residency

All customer data is stored in Cloudflare D1, Western Europe (Amsterdam). Data does not leave the EU except when processed by Anthropic for AI features (infrastructure metadata only, no personal data).

Reporting a vulnerability

If you discover a security vulnerability in AZClarity, please email support@azclarity.com with details. We will acknowledge within 24 hours and aim to resolve critical issues within 48 hours. Please do not disclose publicly until we have had the opportunity to investigate and remediate.

Compliance

ICO registration: ZC173030 (Stephen Bennett, sole trader)
UK GDPR: Compliant — see Privacy Policy
Data processing: Lawful basis documented, DPA in place with sub-processors