CloudRift — Data Inventory & Privacy

What data CloudRift collects, stores, and processes

What CloudRift Stores

Azure Resource Metadata

Resource names, types, locations, resource groups, Azure resource IDs, tags, monthly cost estimates

Identity Metadata

Azure AD user display names, UPNs, MFA status, license SKU names, group names and member counts

Performance Metrics

CPU utilization %, network bytes in/out, active connection counts (from Azure Monitor)

CloudRift Account Data

Your name and email, bcrypt-hashed password, role, plan, audit log of your actions

Credentials (encrypted)

Client Secret encrypted at rest with AES-256 Fernet. Tenant ID and Client ID stored unencrypted.

What CloudRift Never Accesses

Resource Contents

Files in storage, database rows, blob data, VM disk contents, application code

Customer Data

Any data stored inside your cloud resources

Network Traffic

Packet data, TLS payloads, application-layer traffic

Secret Values

Key Vault secret values, connection string passwords

Payment Data

Card numbers handled by Stripe — never stored in CloudRift

Hosting & International Transfers

CloudRift is hosted in the United States. If you are located in the EU/EEA, UK, or Switzerland, your account data and cloud resource metadata are transferred to and processed in the US. These transfers rely on our subprocessors' Standard Contractual Clauses and/or EU–US Data Privacy Framework certifications. A signable Data Processing Agreement (DPA) is available on request — email privacy@cloudrift.tech.

Subprocessors

Emergent (app hosting) — Application and database hosting — US
Stripe — Payment processing (card data never touches CloudRift) — US, global
Anthropic — AI analysis of resource metadata for recommendations — US
Twilio SendGrid — Transactional and report emails — US
Data Retention
Scan results: retained until account deletion · Audit logs: 90 days · Resource metrics: 30 days · All data purged within 30 days of account closure

Your rights: You can request access to, correction of, or deletion of all your data at any time — self-service under Settings → Privacy (Export my data / Delete my account, automated purge within 30 days) or by email. You can revoke CloudRift's Azure access at any time by deleting the service principal in your Azure Portal.

Cookies & tracking: Non-essential analytics and advertising trackers run only after you consent via the cookie banner. The complete inventory of browser storage and third-party scripts is in the Cookie Policy.

Certifications: SOC 2 planned Q3 2026 · ISO 27001 planned Q4 2026 · GDPR architecture compliant

Last updated: August 2026 · cloudrift.tech

CloudRift uses essential cookies to run the app, and — only with your consent — analytics and advertising cookies to understand usage and measure campaigns. Details in the Cookie Policy.