Security Policy

The short version

Access to your AWS account

You give us access by deploying an IAM role into your own account. This matters more than it might look:

• We never hold your credentials. There are no access keys to leak. We assume a role you control, which issues short-lived temporary credentials that expire on their own.
• The role is scoped to reading. It grants AWS's managed read-only policy plus the cost and recommendation APIs. It has no permission to create, modify or delete your resources.
• It is locked to us with an external ID. The trust policy requires a secret value unique to your connection, which prevents the confused deputy problem — nobody else can assume your role even if they learn its ARN.
• You can revoke it instantly by deleting the role. No ticket, no waiting on us.

The one exception is that on connection we enable AWS Compute Optimizer and Cost Optimization Hub for the account, which is what makes their recommendations available to you. That is the only write we perform, and it changes no infrastructure. It is set out in our Terms of Service as well, because we would rather over-disclose it than have you find it in a CloudTrail log.

What our scanners do not touch

We read configuration and cost metadata: what exists, how big it is, whether it has been used, what it costs. We do not read the contents of your data stores, files, logs or network traffic. A finding can tell you a bucket is costing you money; it cannot tell you what is in it, because we never looked.

Protecting what we store

• Encryption in transit. Everything is served over HTTPS, and all calls to AWS use TLS.
• Encryption at rest. Our database is Amazon DynamoDB, encrypted at rest by default.
• EU residency. Account, connection and scan data lives in AWS Ireland, and our AI analysis is pinned to EU regions.
• No passwords. Sign-in is OAuth only, through Google or GitHub, so there is no password database to steal.
• Least data. On the free plan, resource identifiers and details are removed on the server before results are sent to the browser, rather than hidden in the interface.
• Short-lived onboarding tokens. Pending connection tokens expire automatically after one hour.

API keys

Your AI coding tool authenticates with a bearer API key tied to your account. Treat it like a password: it can read your findings. If one is exposed, email us and we will revoke it. Keys grant no access to your AWS account beyond what your connected role already allows.

Our suppliers

We build on AWS, Vercel and Paddle, and rely on their infrastructure security. Card data never reaches our systems — Paddle handles payments as merchant of record and maintains PCI DSS compliance for them. The full list of who processes what is in the Privacy Policy.

Reporting a vulnerability

If you find a security problem, please tell us before you tell anyone else. Email security@junglecleaner.com with enough detail to reproduce it.

• We aim to acknowledge within 2 working days.
• We will keep you updated while we investigate, and tell you when it is fixed.
• We are happy to credit you publicly if you would like that.

We are a small team and do not run a paid bug bounty. In return for reporting in good faith, giving us reasonable time to fix things, and not accessing or destroying anyone else's data, we will not pursue legal action over your research.

Please do not run automated scanners against production, attempt denial of service, or use social engineering against our staff or suppliers.

If something goes wrong

If a breach affects your personal data, we will notify the Comissão Nacional de Proteção de Dados (CNPD) within 72 hours of becoming aware of it where the law requires, and we will tell you directly if there is a high risk to you. We will say what happened and what to do about it, rather than issuing something vague.

What we have not done