Security
Security & read-only Azure access
Cerberus Cloud is built around one rule: read access, never write access. This page explains exactly what Cerberus can see, what it can never do, and how your data is handled.
How Cerberus connects
Cerberus connects to each Azure tenant through a standard Azure service principal, scoped to Reader and monitoring-read roles. No agent is installed inside your environment, and no software runs on client infrastructure. The connection is established and revoked entirely from the Azure side — you control it with the same access-management tools you already use, and you can revoke it at any time without needing to contact Cerberus.
What Cerberus can never do
The service principal Cerberus uses has no write, modify or delete permissions on any Azure resource, at any layer. Cerberus cannot create, change, restart or remove a resource, cannot alter cost-management or budget settings, and cannot access resource data planes (for example, the contents of a database or storage account) — only the inventory, configuration, monitoring and billing metadata needed to produce a finding. Every remediation Cerberus surfaces is implementation guidance for your engineers to review and apply themselves; nothing is ever applied automatically.
What data Cerberus processes
Cerberus processes Azure resource inventory, configuration and monitoring metrics, and cost and usage data pulled from Azure Cost Management. This data is used to generate findings and the savings/delivery history shown in your portfolio view. Cerberus does not access the contents of customer workloads (application data, databases, file storage, secrets) — only the metadata layer described above.
In transit and at rest
All connections between Cerberus and Azure use Azure's own authenticated, TLS-encrypted APIs — the same transport-layer protection Azure enforces for every service principal integration. Data at rest is encrypted using standard provider-managed encryption.
Where things stand today
Cerberus is an early-stage platform. We do not yet hold a formal security certification such as SOC 2 or ISO 27001, and we are not going to claim one we don't have. What we do commit to: the read-only access model described on this page, no data resale or sharing beyond what's needed to run the service, and direct engineering accountability — security questions reach the people who built the platform, not a support queue. If a prospective client's procurement process requires a specific control, questionnaire or certification, contact us and we'll work through it directly.
Questions
Security questions can be sent to sales@cerberus-cloud.com — ask us anything before you connect a tenant.