Security

Local flow — nothing to grant. Run the open-source collector script (github.com/convops-io/nuberio-audit-collector) with your own AWS credentials on your own machine. It writes a JSON file. You paste that file into the browser, and the report is built entirely client-side. No AWS credential of any kind — yours or a generated role — is ever sent to Nuberio.

Connected flow — a scoped, temporary IAM role. If you'd rather not run a script locally, deploy a small CloudFormation template that creates a read-only IAM role in your own account. Nuberio's backend assumes that role once to run the scan, then the credentials expire.

The role grants only list/describe/get-style read permissions, scoped by name to the ~20 AWS services the audit actually checks: CloudWatch (alarms, alarm history, metric data), EC2, S3 (bucket count only — never s3:GetObject, so object contents are never read), RDS, Lambda, ECS, EKS, load balancers, DynamoDB (table count only), ElastiCache, SQS, API Gateway, CloudFront, CloudTrail, Secrets Manager (secret names only, to flag stale rotation — never the secret values themselves), GuardDuty, Security Hub, Config, Trusted Advisor, Service Quotas, Resource Explorer, and read-only IAM checks (for the unused-admin-role finding).

There is no write-access opt-in for Audit — unlike Nuberio's other products, which do have an explicit, separately-approved opt-in for taking remediation actions, the audit role never requests write permissions of any kind.

Each role session is bound to the one audit that created it via a unique ExternalId (the audit's own session token) and expires after 1 hour (MaxSessionDuration). A stale or reused role can't be assumed for a different, unrelated scan.

To revoke access at any time: delete the CloudFormation stack, or just the IAM role, from your AWS console. This requires no action on Nuberio's side.

Nuberio never stores your AWS credentials. The connected flow authenticates via STS AssumeRole — Nuberio's backend holds only the role ARN (not a credential) and AWS issues short-lived session tokens per scan.

The local flow involves no credential handling on Nuberio's side at all — the collector script uses your own local AWS CLI credentials, and only its JSON output (resource inventory, alarm config, findings — no credentials) ever reaches the browser.

Your email address, the connected role ARN (if used), and the full report — score, alarm classifications, findings, recommended fixes — are stored for 30 days from when the audit completes, then deleted automatically.

You can re-run the audit as many times as you like; there's no limit.

Nuberio does not sell, license, or share your audit data with third parties.

Audit records are stored in DynamoDB, encrypted at rest by default.

All data in transit — the browser, the API, and the AWS SDK calls made during a scan — is encrypted using TLS.

Nuberio is working toward SOC 2 Type II certification. Formal audit documentation will be made available to customers once the process is complete.

Nuberio processes personal data as a data processor acting on behalf of its customers (who are the data controllers), in accordance with applicable data protection law including the GDPR. For data protection enquiries, email privacy@nuberio.com.

If Nuberio becomes aware of a security incident that affects customer data, affected customers will be notified promptly — and in any case within 72 hours — via the email address they provided.

To report a security vulnerability, email security@nuberio.com. We review all reports and aim to respond within 5 business days, and follow a 90-day responsible disclosure window.