Read-only. Self-hosted. Your keys stay yours.
The whole product is built on one boundary: Cloudkeel-DD runs inside your environment and uses read-only access for detection. Your credentials stay yours, findings live in your database, and configured notifications and remediation pull requests can send finding data to destinations you choose.
Read-only, always
Cloudkeel-DD never creates, updates, or deletes a resource, and never runs terraform apply. Detection and remediation are separate: a revert plan is generated for you to review and run yourself, never applied automatically.
Your credentials never leave your cluster
There is no SaaS backend. No vendor holds keys to your estate. Integration credentials are encrypted at rest. Detailed implementation information is available through a private technical review.
Least privilege, documented
The exact permissions each connector needs are published per cloud, scoped read-only. Our own verification used exactly these: a read-only IAM user on AWS, a scoped ServiceAccount + read-only ClusterRole on Kubernetes. Nothing broader.
Kubernetes Secret values are never read
The Kubernetes connector reads workload manifests and live object state to detect drift. Secret object values are never read or diffed: they never enter the diff engine at all.
Private technical review
Internal product architecture is shared directly with customers and MSP partners as appropriate. Request a review. Customer installation and operations documentation remains available.