Security
You are handing us credentials. Here is how we treat them.
A security product has to hold itself to the standard it measures others against.
Read-only by design
Every check reads. Nothing A1 Cloud Guard does requires permission to create, modify or delete a resource. On AWS we recommend a cross-account role with an external ID rather than a long-lived access key; on Azure a Reader service principal; on Google Cloud a Viewer plus Security Reviewer service account.
Credentials encrypted at rest
Access keys, service account keys, client secrets, SSH keys and API tokens are sealed with AES-256-GCM before they reach the database. After saving, values are never returned to the browser — the interface shows masked identifiers, and an edit form shows a placeholder rather than the stored secret.
Verified SSH host keys
The first time A1 Cloud Guard connects to a Linux host, the host key fingerprint is recorded alongside the credential. Every later scan verifies it and refuses to connect if it changed, so a machine-in-the-middle cannot impersonate your host and harvest the login.
Account protection
Two-factor authentication uses TOTP with any authenticator app, backed by single-use recovery codes. Repeated failed sign-ins trigger per-account backoff. Changing a password or disabling 2FA invalidates every other active session immediately.
Isolation between organizations
Credentials, reports, findings and integrations belong to an organization, and every query is scoped to the organization of the person making the request. A resource belonging to another organization is indistinguishable from one that does not exist.
Audit logging
Sign-ins and failures, credential changes, scan submissions, integration changes, invitations and role changes are recorded with the actor, IP address, user agent and timestamp. Organization admins can read the trail for their own organization.
Domain verification for web scans
A web target must be proven under your control before any scan runs against it, so A1 Cloud Guard cannot be pointed at a third party.
Read the detail in the product
Create an account and inspect the audit log, credential handling and access controls yourself.