Security and data isolation

The short version: your data lives in a dedicated workspace of its own and is never mixed with another customer’s.

This page is the non-technical explanation. If your security team wants the architecture, ask us — there’s a deeper document written for exactly that conversation.

Your own workspace

CloudMonitor is built on Microsoft Fabric, Microsoft’s enterprise data platform. Inside it, every customer gets a separate, dedicated workspace.

The analogy that fits: a building where each tenant has their own locked suite. Same trusted building, entirely separate spaces. Your cost data sits in your suite. Another customer’s sits in theirs. There is no shared table that both of you read from with a filter in between — the separation is structural rather than a rule applied at query time.

What CloudMonitor reads

CloudMonitor reads the standard cost and usage data your cloud provider already produces — the same exports you can generate yourself from the Azure portal. Cost records, pricing, reservations.

There is no personal data in it. These datasets contain resource identifiers, meters, quantities, prices, dates and your own resource tags. Not names, not email addresses.

The one thing that is personal is the list of people you invite to CloudMonitor, which exists so they can sign in and so an audit trail can record who changed what.

If you connect Microsoft 365

That’s a separate, explicit decision, and it’s opt-in.

Connecting it requires a Global Administrator to approve a consent screen at Microsoft, and the permissions granted are read-only. CloudMonitor never writes to your Microsoft 365 tenant and never stores a credential for it. The consent dialog lists every permission and why it’s needed before you approve anything — it’s worth reading rather than clicking past.

See how to connect Microsoft 365.

Who can see what, inside your organization

Two layers, both yours to control:

• Signing in is controlled by your own Microsoft identity. CloudMonitor doesn’t hold passwords.
• Seeing costs is controlled by cost group membership. Someone added to CloudMonitor sees only the cost groups they belong to, plus the catch-all Unallocated group.

Admins in your organization see everything. See Roles and access for the full matrix.

When someone leaves, archive them rather than deleting them: it removes every access immediately while keeping the audit trail of what they did intact.

The audit trail

Budget changes, membership changes, triage decisions and comments are recorded against the cost group they affect, with who and when. It’s on the Audit trail tab of any cost group.

This is the reason archiving beats deleting, and the reason dismissing an anomaly asks for a reason rather than accepting a shrug.

Questions worth asking us

We’d rather answer these than have you assume:

• Where is our data physically stored?
• Who at CloudMonitor can access it, and under what circumstances?
• What happens to it if we stop being a customer?
• Do you hold current certifications?

Help & support in the app reaches the team, and status.cloudmonitor.ai publishes service health independently of the product.