Your data stays in your cloud
The CloudLens agent runs inside your own Azure subscription, with read-only permissions. It is the only way CloudLens sees your environment — CloudLens never connects to your cloud directly.
When you open a dashboard, CloudLens asks your agent for summaries — totals, counts and short top-lists — to draw the page. Your cloud data is not stored by CloudLens.
Resource names are withheld unless you choose to show them. Names, emails and sign-in details of the people in your cloud are never collected.
What runs in your account
- A function app and the identity it runs as, with no keys or passwords
- A private, encrypted storage account for its results and history
- A key vault holding the one key it shares with CloudLens
All of it is in the resource group you choose. History is kept 400 days by default, and you can change it. Removing the deployment removes everything. Agents for AWS and Google Cloud are in preview and follow the same design.
Only CloudLens can talk to your agent
Setup uses a one-time code that expires after 24 hours. The agent uses it once to register itself, and its key goes straight into your own secret store — no one has to copy or share a secret. Each agent answers only verified requests from CloudLens for your organization and ignores everything else.
Every organization isolated
Each customer organization is separated from every other one at every layer. You only ever see your own organization, each agent serves exactly one organization, and each connection has its own key. Deleting your organization removes everything CloudLens holds for it.
What CloudLens keeps
Only what is needed to run your account: your organization, members and their roles, connection names and agent addresses, whether each connection is working, email recipients, billing status, and a log of changes made in CloudLens. Your cloud data is not part of it.
If you contact us through Support, we also keep what you write in your requests, so we can help you. Please don’t include secrets; obvious ones such as keys and passwords are hidden automatically before saving. If you choose to share connection status with a request, that covers whether each connection and data source is working and which agent version it runs, never resource names or cloud data.
Email summaries and alerts
Weekly summaries are built when they are sent, from the same summaries as your dashboards: scores, totals and the top actions, never resource names. Alerts say only which connection or data source needs attention. Recipients open CloudLens for the details.
Read-only permissions
Reader, Cost Management Reader, Monitoring Reader and Security Reader on the tenant, management group or subscriptions you choose. The full list.
The agent can write only to its own storage and secret. It cannot create, change or delete your resources.
Reporting a security issue
Email security@nexovia.cloud.