Security and data

Security and privacy

• Cloud credentials verified then encrypted, never shown again.
• At the providers, the tool only reads; the access is read-only, except Scalingo's token, Scalingo offering none.
• Password of at least 12 characters, with an uppercase letter, a lowercase letter, a digit and a special character. All five requirements are checked as you type; creation or reset is blocked until they are met and confirmation matches. The identity service checks them on the server too.
• Two-factor authentication mandatory for every user, with an authenticator app.
• Permissions by role: a viewer changes nothing, the cloud accounts and the settings are reserved for the administrators and the owner, the subscription for the owner.
• Retained exports are personal: only their author has access to them.
• Each client's data is partitioned: no page or action reads the data of another account.
• The platform's administration interface shows neither your costs nor your credentials: of your spend, it only shows a bracket, to check that your plan covers it. Direct access to the database, where credentials are encrypted, is kept to Move2Cloud's technical operations (maintenance, backups).

Your data

FinOps Move2Cloud reads your costs and your inventory: amounts, services, regions, the names of your projects, accounts and resources, usage measures. It never reads what your resources hold (files, databases, messages).

Enlarge

My account → Security: your Move2Cloud account page (password and two-factor authentication), your sessions, the sign-out after inactivity, your data and the deletion of the account.

Actual sizeClose

What you control

• Removing a cloud account deletes its credentials and the costs read with it.
• The owner switches the AI off in Organisation settings → Security: nothing more is then sent to it.
• Your exports stay personal: only their author can open them.
• Your account is deleted from My account → Security, the organisation from Organisation settings → Security: deleting it erases its accesses, cost history, budgets, alerts and generated files; your Move2Cloud account is deleted only if you tick its box.
• To access, correct or get back your data, write to contact@move2cloud.fr.

What Move2Cloud commits to

• Your data is neither sold nor used for advertising.
• The platform's administration interface shows neither your costs nor your credentials: of your spend, it only shows a bracket, to check that your plan covers it. Direct access to the database, where credentials are encrypted, is kept to Move2Cloud's technical operations (maintenance, backups).
• The AI analysis receives cost data only, without account numbers, e-mail addresses or the names of your organisation, cloud accounts and team.
• No advertising cookie and no audience measurement.

The details are in the privacy policy, at the bottom of every page of the site.

Sovereignty

FinOps Move2Cloud and your data are hosted in France, with French and European providers.

• Application, database and backups: Scalingo, a French host, Paris region; the Move2Cloud sign-in service as well.
• E-mails, reports, exports and a backup copy: Scaleway, in Paris.
• Online payment: Mollie, a European provider (Netherlands); Move2Cloud keeps neither card number nor IBAN.
• Apart from the integrations you turn on (Jira, Slack, Teams, GitHub, GitLab, outgoing webhooks), which receive what their use needs, only the AI analysis, optional, goes to a specialised provider based in the United States, under the European Commission's standard contractual clauses, with limited and pseudonymised data.
• No client data is kept at AWS: Move2Cloud only holds there the CloudFormation template offered to AWS clients and the identity that assumes, read-only, the role they create.