Privacy Policy

Security & Privacy

We take our responsibility to help protect your data and environments which starts with protecting our own.

Governance

Building Security is one thing — providing it is another.

Cloud Aisle’s security and compliance posture is governed by a custom Cloud Aisle Information Security Management System (ISMS). This ISMS is developed by looking at external compliance regimes (SOC2, ISO, etc.), best practices from organizations like SANS and AWS, and internal Cloud Aisle requirements.

Cloud Aisle systems and personnel are expected to abide by the requirements in the ISMS and its sub-policies and procedures. This activity is then mapped to external compliance regimes to provide evidence for our auditors. Cloud Aisle currently audits against SOC2 and ISO27001 on an annual basis. In addition to these regimes, we are able to map our ISMS to many other regimes or requirements at customer request.

Access to your AWS Environment

Many Cloud Aisle products and services require that customers provide some form of access to customer-controlled AWS accounts to Cloud Aisle personnel. This access is protected using native AWS security tools like Identity and Access Management (IAM).

Any access to customer infrastructure starts with the Cloud Aisle resource authenticating to Cloud Aisle’s IAM tooling (currently Okta) which requires Multi-Factor Authentication (MFA). Note that only roles that require customer access are allowed to authenticate following a least privilege model and all authentications on the Cloud Aisle side are logged and audited.

Once authentication is complete, the Cloud Aisle resources may access the customer environment in a variety of ways.

Cloud Aisle may interact directly with the AWS portal in the customer account to make manual changes or gather information.

Cloud Aisle may use internal tools and open source tooling like Terraform to interact with the customer’s account through the AWS APIs.

Cloud Aisle may use AWS Systems Manager (SSM) to interact with customer AWS infrastructure such as EC2 instances.

Data Protection

Cloud Aisle differs from many of your SaaS partners in that our job is to help manage your AWS environment. Your data will stay in your AWS accounts with full access to your team and under your control. Cloud Aisle does not collect, process or store any data that you have in your AWS account.

Cloud Aisle does collect data about the team we will interface with — primarily contact information like names, emails and phone numbers. We also collect data that we need for billing — this includes the usage generated in your AWS environment. Data that Cloud Aisle collects is protected both in transit (using common protections like TLS) and at rest using standard AWS encryption techniques.

Enterprise Security

Cloud Aisle is capable of assisting customers with a wide range of security needs. You can visit our Cloud Aisle One product page for more information. This section details Cloud Aisle’s approach to security for our internal systems.

Cloud Aisle may interact directly with the AWS portal in the customer account to make manual changes or gather information.

Cloud Aisle may use internal tools and open source tooling like Terraform to interact with the customer’s account through the AWS APIs.

Cloud Aisle may use AWS Systems Manager (SSM) to interact with customer AWS infrastructure such as EC2 instances.

Report A Security Problem

Cloud Aisle believes that working with skilled security researchers can identify weaknesses in any technology. If you believe you’ve found a security vulnerability in Vanta’s service, please notify us; we will work with you to resolve the issue promptly.

Disclosure Policy

• If you believe you’ve discovered a potential vulnerability, please let us know by emailing us at security@cloud-aisle.com. We will acknowledge your email within one week.
• Please provide us with a reasonable amount of time to resolve the issue before disclosing it to the public or a third party. We aim to resolve critical issues within ten business days of disclosure.
• Make a good faith effort to avoid violating privacy, destroying data, or interrupting or degrading the Cloud Aisle services. Please only interact with accounts you own or for which you have explicit per Cloud Aisle from the account holder.
• Cloud Aisle does not currently offer a formal bounty program. Reports demanding bounties before disclosure will be ignored.

Exclusions

Cloud Aisle is providing this service to help ensure a safe and secure environment for all of its users. As such, any users believed to be engaging in the below activities will have their user credentials immediately deactivated.

While researching, we’d like you to refrain from:

• Denial-of-Service (DoS)
• Spamming
• Social engineering or phishing of Cloud Aisle’s employees, customers, or contractors
• This policy applies to the Cloud Aisle Application hosted at control.cloud aisle.com and to any other subdomains or services associated with the Cloud Aisle App.
• Thank you for helping to keep Cloud Aisle and our customers safe!

Have any feedback, questions, or suggestions?

Cloud Aisle is always open to feedback, questions, and suggestions. If you would like to contact us, please email us at info@cloud-aisle.com.