Read-only by design
We never modify AWS resources, tags, configurations or deployments. An inventory describes your network layout and security rules, so it has to be safe to run: these are properties of the product, not promises on a slide.
Never changes your cloud
BunBunCloud assumes a read-only role in each account. The generated policy is List, Describe and Get calls only (plus Service Catalog's read-only search). It does not tag, stop, delete or create anything.
Your data kept apart, or in your own AWS
Your data is kept separate from every other customer's, and your team only ever sees your own workspace. On Scale, we can run a dedicated instance for you, or you run it in your own AWS; then nothing is sent to us at all, not even telemetry.
No agents, and you hold the key
Nothing to install on your instances or clusters. Each account needs one IAM role from a CloudFormation template we generate (or a StackSet for many accounts). Delete the role and access ends immediately.
Configuration, not contents
BunBunCloud records how resources are configured. It deliberately does not read what they contain, and drops personal data it does not need.
- Secret and parameter values are never read; Secrets Manager and Parameter Store are listed by metadata only
- No queue messages, stream records, log events, CloudTrail events, traces or database data
- IAM policy documents are analysed and fingerprinted, not stored; environment variables that look like secrets are redacted
- Terraform reports what it manages from CI; state files, which hold secrets, are never read
- From monitoring and incident tools: no alert message text, no recipients, no responder names
Every exclusion is documented
The onboarding guide lists, service by service, what is never read, what is redacted and what is reduced to a count or a fingerprint, so your security team can review it before you connect an account.
Available on request before an assessment.
Request the security packBuilt to be exposed only to the people who need it
Roles and audit log
Viewer, editor and admin roles, plus team admins for their own team. Every change made in BunBunCloud is recorded in an audit log.
Encrypted credentials
Tracker tokens, chat webhooks and observability keys are encrypted with AES-256-GCM, written once and never returned by the API.
Hardened sessions
Passwords hashed with scrypt; signed session cookies; state-changing requests require a custom header that browsers will not send cross-site.
Outbound requests guarded
Webhooks and self-hosted integrations refuse loopback, link-local and cloud metadata addresses, do not follow redirects and time out.
Signed webhooks
Generic alert webhooks can carry an HMAC-SHA256 signature with a timestamp, so receivers can verify and refuse replays.
Chat messages without identifiers
Alert channels can send summaries with ARNs, account IDs and IP addresses removed.
Data regions
Choose where your workspace's data lives when you register: Europe (Frankfurt, Germany), where it is stored and processed in the European Union, or Asia-Pacific (Singapore). Each region runs separately, with its own database.
Compliance
BunBunCloud does not hold third-party certifications today. We process customer data under our Data Processing Addendum (GDPR, UK GDPR and Swiss FADP), with the sub-processors listed; ask us about our security practices. Self-hosted on Scale, it runs inside your own environment and inherits your controls.
Know your AWS infrastructure in 10 minutes
Connect a read-only role. Get the infrastructure report: what you run, what is unhealthy, where environments differ and what it costs. Free, no commitment.