Security & Compliance

1. The Zero Egress Promise

At AIPrunr, we believe that the best way to secure your data is not to touch it. Our architecture is fundamentally designed around "Zero Egress" and strict least-privilege principles.

AIPrunr runs entirely within your infrastructure (On-Premise or Private Cloud). Your credentials, cloud resource data, and financial insights never leave your network.

2. Data Handling & Residency

Because AIPrunr operates as a self-hosted appliance, you retain absolute sovereignty over your data.

• Data Residency: All data stored by AIPrunr resides in the PostgreSQL database you choose: on the appliance itself or on your own database server. We have no cloud database that mirrors your sensitive information.
• Data Retention: You control the retention period. You can purge data at any time using the built-in "Data Purge" tools in the dashboard.
• No Telemetry: The appliance does not send usage metrics, crash reports, or metadata to AIPrunr HQ.

3. Encryption Standards

We enforce industry-standard encryption for data at rest and in transit.

• At Rest: Cloud and datacenter credentials are always encrypted using AES-256-GCM before being written to the local database.
• In Transit: The dashboard is served via HTTPS (with HSTS enabled). All calls to your cloud providers (AWS, Azure, Google Cloud, Oracle Cloud) use HTTPS (TLS).

4. IAM Read-Only Access Model

AIPrunr requires Read-Only permissions to function. We never ask for write or delete permissions on your cloud resources. This ensures that a compromised AIPrunr instance cannot disrupt your production services.

Sample AWS IAM Policy

Attach this policy to the IAM user or role used by AIPrunr. It lists exactly the read-only calls the appliance makes (version 1.6.21): inventory, utilisation metrics, costs, and flow logs. Alternatively, the AWS-managed ReadOnlyAccess policy also covers everything AIPrunr needs.

One AWS-side step this policy alone doesn't cover: per-resource cost data additionally requires "Resource-level data" to be opted into from the Cost Explorer Settings page in the AWS Billing Console (a console setting, not an IAM grant) -- until that's on, discovered assets will show without dollar figures.

Note on the "elasticloadbalancing" action: this single action covers both Classic Load Balancers and modern Application/Network Load Balancers -- AWS uses one IAM action namespace for both APIs, so no separate "elasticloadbalancingv2" permission exists or is needed.

Note on the CloudWatch actions: cloudwatch:GetMetricStatistics and ListMetrics read utilisation metrics (CPU, requests, connections) for instances and managed services. The logs: actions run read-only CloudWatch Logs Insights queries over your VPC flow logs. AIPrunr reads flow logs only when they are delivered to CloudWatch Logs; flow logs sent only to S3 or Firehose are reported as not readable. Without a permission, the related data is shown as unmeasured, never guessed.

Scanning an entire AWS Organization (optional): the policy above is everything needed for a single AWS account. To auto-discover every account in an AWS Organization instead, the credential configured in AIPrunr (typically in the management/payer account) additionally needs organizations:ListAccounts and sts:AssumeRole (scoped to the target role's ARN in each member account) -- these are separate from, and granted on top of, the read-only policy above, since they belong to the account doing the assuming rather than the account being read.

Equivalent read-only grants for OCI and Azure: OCI additionally needs a tenancy-level policy granting read usage-report in tenancy (cost data in OCI is tenancy-wide, not compartment-scoped). Azure additionally needs the built-in Cost Management Reader (or Billing Reader) role assigned alongside the Reader role already used for discovery.

GCP: additional permission for Cloud Run request-volume data: reading how much real traffic a Cloud Run service has taken (used to detect genuinely idle services, rather than guessing) requires the service account used by AIPrunr to also hold roles/monitoring.viewer on the project, granted alongside whatever discovery role is already in use.

5. Security Review Simplified

To speed up your security review, we provide the AIPrunr Security & Compliance Overview: what the appliance reads and stores, every network connection, access control, encryption, logging, and how its controls relate to SOC 2, GDPR, HIPAA and FedRAMP. It is a description of the product, not a certification. From the next appliance release it is also included in the Compliance Add-on, together with a read-only self-audit script your administrators can run.

6. Trust & Malware Defense

Because the AIPrunr appliance runs as a local Linux program in your network, we design the product to be transparent, auditable, and secure against malware flags:

• Agentless Security: AIPrunr operates strictly out-of-band and never executes binary code or installs software on your production servers or virtual machines.
• Minimal Outbound Connectivity: The appliance connects only to the cloud APIs and datacenter platforms you configure. A datacenter-only installation can run in a subnet with no internet access; cloud scanning needs HTTPS access to that cloud's APIs. It never connects to SANSIDERA.
• Inspectable Package: The appliance ships as a zip of a Linux binary, the dashboard and plain shell scripts, which you can inspect and scan with your own tools (e.g. Snyk, Trivy) before running it.

7. Vulnerability Management

Security fixes are delivered as new versioned releases, each with a fix log. Report a suspected vulnerability to support@aiprunr.com.