Independently certified to ISO 27001, ISO 9001, and ISO 42001.

Next to nothing. CloudMonitor's platform runs entirely in our Microsoft Fabric tenancy — no Fabric capacity for you to license, no Hubs deployment, no compute or managed app in your tenant. The only Azure resource you create is one storage account that receives your scheduled cost exports; CloudMonitor uses scoped access to process that cost data in a dedicated customer environment within our Fabric tenancy. The annual license covers the Fabric capacity we run for you, and your team just gets a hosted SaaS URL and a Fabric app.

Yes. Every permission CloudMonitor asks for is the minimal access needed to read your cost and usage data — read-only wherever Azure allows, scoped to the subscriptions and billing scope you choose. The only write or management access anywhere in setup is a single, tightly scoped role on the storage account that receives your cost exports, used only to create and run that export. Full detail is in the access guide.

CloudMonitor is a hosted SaaS platform running in our Microsoft Fabric tenancy. Azure Cost Management writes the raw FOCUS export to a storage account you own. CloudMonitor uses scoped access to process the cost data in a dedicated customer environment within our Fabric tenancy, in the supported data residency region you choose at sign-up. Every customer gets a dedicated Microsoft Fabric workspace, so customer environments are isolated and data is not co-mingled. Data is encrypted in transit and at rest, CloudMonitor staff access is restricted and audited, and only your authorized users see your reports.

You configure a FOCUS cost export to an Azure Storage account in your tenant and grant CloudMonitor the required scoped roles. Billing and resource metadata access is read-only; one management role is limited to the dedicated export account so CloudMonitor can create and run the scheduled export. CloudMonitor processes the cost data in your dedicated Microsoft Fabric workspace within our tenancy, where it becomes your reports. Only billing and resource metadata moves — never the data inside your resources. See the Information Trust Center for the full data-flow detail.

Every customer gets a dedicated Microsoft Fabric workspace, and your data lives in that workspace's own OneLake storage. The workspace is the isolation boundary, so your data is never co-mingled with another customer's. The CloudMonitor application is scoped to your workspace and has no path to read across workspaces. Authentication and authorization are handled entirely by native Microsoft Entra ID and Fabric workspace roles; we have not built a custom identity or permissions layer on top, so access is governed by the same Microsoft security model that protects the rest of your Azure estate. Only the Entra users you authorize can reach your data. See the Information Trust Center for the full posture.

No. CloudMonitor processes billing and resource metadata, CloudMonitor configuration, account profile fields used for sign-in, and Fabric capacity or AI token usage metrics when you connect those features. It has no access to secrets or content inside your VMs, databases, storage objects, or other workloads.

Least-privilege access scoped to the subscriptions and billing data you choose. Billing and resource metadata access is read-only, and you can revoke every role from the Azure portal. The one management-role exception is limited to the single storage account that receives your cost exports and is used only to create and run that export. CloudMonitor has no write access to your workloads or the data inside your services.

CloudMonitor's access to your cost and usage data is read-only. The one management role it needs — on the single storage account that receives your cost exports — exists only so CloudMonitor can create and run the scheduled Azure Cost Management export that lands your billing data there. Azure requires write access on the destination account to set up an export; it gives CloudMonitor no access to your other resources or to the data inside your services, and reading the exported files back uses a separate read-only role. See the access guide.

The Marketplace SaaS app uses delegated User.Read during interactive sign-in to retrieve the signed-in user's own basic profile. It is not an application permission and does not provide directory-wide access to other users, mail, files, groups, or workload content. Background ingestion runs app-only and uses CloudMonitor's service principal with scoped Azure RBAC; it does not use Graph for cost ingestion.

No. CloudMonitor connects through a multi-tenant service principal that we provide and you authorize — you don't create or hand over a client secret, and no storage account access keys are shared. CloudMonitor authenticates to your storage and the Azure APIs over Microsoft Entra ID using the scoped Azure role assignments you grant, which you can revoke at any time.

Very little. CloudMonitor's cost exports are small files and Azure Data Lake storage is inexpensive, but they accumulate over time. You can cap the cost by applying an Azure Blob Storage lifecycle-management policy that automatically deletes exports older than a retention window you choose — keeping enough history for the trends you rely on. It's the only Azure resource you create for CloudMonitor.

Yes — Azure Activity Log shows every read against your subscriptions. The reads originate from CloudMonitor's authorized identity and are logged like any other Azure action.

Yes — ISO/IEC 27001:2022 (Information Security), ISO 9001:2015 (Quality Management), and ISO/IEC 42001 (AI Management). Certificates available under NDA — see the certification statement.

CloudMonitor does not currently have a SOC 2 report. We can share our current ISO/IEC 27001 certificate and available audit material under NDA through the Security Pack. See the ISO certification statement for scope, certifying body, and audit cadence.

CloudMonitor operates a certified AI management system under ISO/IEC 42001 — covering AI risk assessment, transparency, human oversight, and lifecycle controls. Every agentic FinOps action runs against scoped permissions, an approval workflow, and a reversible audit trail.

CloudMonitor supports TLS 1.2 or later, scans the app and supporting infrastructure for vulnerabilities each quarter, risk-ranks findings, and applies patches against documented targets. A second person reviews production code changes, secure coding practices cover the OWASP Top 10, and MFA protects code repositories, DNS management, and credential stores. System events are logged and reviewed, with security alerts routed for employee triage.

Yes. CloudMonitor maintains documented disaster recovery, backup and restore, and security incident response processes. The current Microsoft Marketplace compliance submission records these controls as vendor-attested. RPO and RTO targets are not published.

CloudMonitor maintains a documented incident response plan. CloudMonitor systems hold cost-management metadata, account profile data, service configuration, and connected-service usage metrics, but not content from inside your workloads. We notify affected customers and relevant authorities without undue delay and within applicable legal and contractual deadlines.

Yes — coordinate via Customer Success. We support customer-initiated penetration tests against the CloudMonitor app and admin app surfaces, subject to an agreed scope, schedule, and rules of engagement.

Yes — CloudMonitor is a Microsoft Solutions Partner with certified software for Azure. The designation confirms the platform has been technically reviewed for interoperability with Microsoft Azure and validated against Microsoft Marketplace customer-success criteria. Procurement teams can reference the Microsoft Learn overview of the designation and the Information Trust Center for the full certification stack (ISO 27001, ISO 9001, ISO 42001, FinOps Specialty Solution, and Microsoft Solutions Partner).

Our current Microsoft Marketplace submission records a retention period of less than 30 days for user data after account termination. The raw FOCUS export stays in your Azure Storage account until you delete it or apply a lifecycle policy. You can revoke CloudMonitor's Azure access immediately from the Azure portal.

Certificates are available for download on request. Open a ticket via the Support Helpdesk and we'll send the current certificates within one business hour.

Annual surveillance audits, with full re-certification every 3 years. Our most recent surveillance was in February 2026.

Every customer gets a dedicated Microsoft Fabric workspace, and their data lives in that workspace's own OneLake storage — the workspace is the isolation boundary, so no two customers' data is ever co-mingled. As a partner you get a portfolio view across your book of business, but each of your customers only ever sees their own data. Full posture is on the Information Trust Center.

You are authorizing the CloudMonitor application in your Microsoft Entra tenant so Azure provisions its service principal. You then grant the required scoped roles: reader access for billing and resource metadata, plus one management role limited to the dedicated export storage account so CloudMonitor can create and run the scheduled export. CloudMonitor cannot read the data inside your workloads or services.

Only your authorized team and the CloudMonitor onboarding team helping you set up. Staff access is limited and audited, and ongoing support access is used only to respond to a request.

Yes, in a limited way. For authentication and access control, CloudMonitor processes the signed-in user's user principal name, object ID, display name, email address, and tenant ID. The FOCUS export contains billing and resource metadata rather than mail, documents, or workload content. Customer-created resource names and tags may contain personal data if your organization enters it there. See what data CloudMonitor can see for the published cost-dataset schemas.