SECURITY
How Zaysa keeps your cloud safe.
How access to your cloud works, what Zaysa stores, and how you stay in control.
HOW ACCESS WORKS
No long-lived cloud keys are stored. Private resources are reached through the connector.
THE CONNECTOR, STEP BY STEP
How your private databases and servers stay private.
One small connector inside your network carries every request. Here is what protects each step, in the order it happens.
No stored cloud keys
On AWS, Azure and Google Cloud, Zaysa connects with short-lived federated identity (OIDC) instead of long-lived access keys. DigitalOcean uses an API token, stored encrypted.
Reading is separate from changing
Seeing your inventory, cost and waste needs read access. Anything that changes your infrastructure runs only with the permissions you grant for it.
You control every action
Autopilot starts in Shadow, where it only shows what it would do. You decide which actions may run on their own, which need approval, and which are always blocked.
Time-bound access
Access to cloud accounts, databases, clusters and servers is granted for a set time and removed automatically when it ends.
Private resources stay private
A lightweight connector inside your network carries access to databases and servers, so they do not need to be exposed to the internet. It only dials out, and runs only instructions signed with your organization’s key.
Every action recorded
Every access request, approval and change made by a person or by Autopilot is recorded. Terminal sessions are kept for 60 days.
Encrypted at rest
Secrets and tokens Zaysa holds are encrypted at rest with AES-256-GCM.
Encrypted, versioned backups
Database backups are encrypted and versioned, so they cannot be silently overwritten.
Questions about security?
Contact usSee what you run, and what it costs.
Free plan, no card needed.