LEGAL & PRIVACYLast updated: September 2026

Privacy Policy

We believe cloud governance should be transparent and secure. This Privacy Policy details how CloudFabric collects, processes, and protects your information across all four platform engines.

1. Scope and Core Philosophy

CloudFabric, Inc. ("CloudFabric", "we", "our", or "us") provides an enterprise cloud management platform spanning FinOps (CloudLens), Security Posture (CloudSec), Developer Platforms (DevHub), and SaaS Intelligence (LicenseLens). Our core architectural principle is minimal data collection. CloudFabric is designed to analyze cloud control plane metadata, infrastructure configurations, and usage metrics. We do not inspect, ingest, or store the contents of your customer databases, application payloads, object storage files, or private code repositories.

2. Information We Collect

A. Account & Operational Contact Information

When you register an account, request a demo, or communicate with our support teams, we collect contact credentials such as your name, corporate email address, organization name, job title, and authentication tokens.

B. Infrastructure and Control Plane Metadata

To deliver visibility and optimization across AWS, Azure, GCP, and Kubernetes, our platform collects configuration metadata, resource tags, cluster topologies, compute/storage utilization metrics, and billing line items via read-only cloud IAM roles and Kubernetes APIs.

C. Microsoft 365 and SaaS Usage Signals

For LicenseLens, we collect Microsoft Graph API telemetry including user active status, assigned SKU licenses, last sign-in timestamps, and service activity indicators to detect unused seats and suggest plan downgrades.

D. Platform Telemetry & Audit Logs

We record administrative actions taken within the CloudFabric console, including user log-in timestamps, IP addresses, feature interactions, and policy modifications for security compliance and troubleshooting.

3. How We Use Your Information

  • Normalize multi-cloud cost data and generate real-time spend analytics.
  • Evaluate security posture against CIS benchmarks and simulate graph-based attack paths.
  • Provide multi-cluster Kubernetes observability and telemetry for developer workflows.
  • Calculate license reclamation opportunities and optimization recommendations.
  • Maintain platform availability, perform preventative maintenance, and secure our systems.
  • Deliver enterprise customer support and respond to technical inquiries.

4. Multi-Tenant Isolation and Data Protection

CloudFabric enforces strict logical and cryptographic tenant isolation: - Encryption: All data in transit is encrypted using modern TLS 1.3. Data at rest is encrypted using AES-256 with tenant-scoped cryptographic keys managed through enterprise HSMs. - Zero Payload Access: CloudFabric operates on control plane APIs (e.g., AWS CloudWatch, Azure Resource Graph, Google Cloud Monitoring). We never access application memory or underlying database records. - Role-Based Access: CloudFabric personnel have no standing access to customer telemetry. Administrative access follows just-in-time, audited elevation protocols with multi-party approval.

5. Subprocessors and Cloud Infrastructure

We host our platform on certified Tier 1 enterprise cloud infrastructure with SOC 2 Type II and ISO 27001 certifications. We maintain a strict vendor vetting program to ensure all subprocessors meet or exceed our security and privacy commitments. Subprocessors are bound by Data Processing Agreements (DPAs) incorporating standard contractual clauses.

6. Your Rights and Data Governance

Depending on your jurisdiction (including the EU General Data Protection Regulation / GDPR and California Consumer Privacy Act / CCPA), you have specific statutory rights regarding your personal information: - Right to Access: Request confirmation of data processing and copies of your account information. - Right to Rectification: Correct inaccurate or outdated corporate contact details. - Right to Erasure: Request permanent deletion of customer account records and associated metadata. - Data Portability: Export infrastructure audit logs and configuration reports in standardized formats (JSON, CSV). - Opt-out: Manage non-essential communications preferences at any time.

7. Data Retention and Deletion

We retain infrastructure telemetry and audit logs only for the duration of your active subscription and service term, plus an automated grace period of 30 days following contract termination, after which customer tenant data is securely and irreversibly scrubbed from active datastores and cold backups.

8. Privacy Inquiries and Contact

If you have questions regarding this Privacy Policy, our data governance practices, or wish to execute a custom Data Processing Addendum (DPA), please contact our Data Protection Officer: Email: privacy@thecloudfabric.com Legal Department: CloudFabric, Inc. Response SLA: Within 48 business hours