Security
The hermit only observes
Read-only, keyless access to your clouds, infrastructure of its own for your organization, and no reading your data without your say.
Access to your clouds
AssetHermit is built to see your clouds, not to touch them.
Read-only
AssetHermit never creates, changes, tags or deletes anything in your cloud. It only reads.
No keys to hand over
AWS uses an IAM role with an External ID, Google Cloud workload identity federation and Azure a managed identity with federated credentials. We store no secrets of yours.
Templates you can read
What you deploy in your cloud is generated for each connection, and trusts only that workspace. When a release changes it, you're asked to update it, with the difference shown.
Permission checks
Every permission is checked as you connect and on every sync. A missing one is named, with the fix.
Fixed addresses
Collectors reach your cloud from fixed IP addresses, which you can allowlist in storage firewalls and policies.
Reads you can see on your bill
What AssetHermit's own reads cost in your clouds, such as BigQuery bytes or log searches, is counted at list price and shown to your admins.
Your data
Each organization is its own set of infrastructure, not a row in a shared table.
Isolated per organization
Each organization has its own sign-in, backend services, data tables and encryption keys, and each workspace its own again.
Encrypted with your keys
Your tables, files, queues and logs are encrypted with a key of your organization or workspace, which no other customer's services can use.
Your region
Your data stays in the region you choose: Stockholm, Ireland, Frankfurt, Paris, London, Zurich, N. Virginia, Ohio, Oregon, Central, São Paulo, Sydney, Tokyo, Mumbai, Singapore. On the Enterprise plan, a workspace can keep its data in a region of its own.
An assistant that stays home
The AI assistant is off until an admin turns it on. It runs within your workspace's geography (the EU or the US), reads only what you may see and keeps conversations private.
Dedicated hosting
With an Enterprise contract, your organization can run in an AWS account and network of its own.
People and sign-in
Your organization's own user pool, your rules for it, and a record of what was done.
Your own sign-in
People sign in with a password and an authenticator code, or with Google or Microsoft, at your organization's own address.
Sign-in policies
On the Team and Enterprise plans, require Google or Microsoft for everyone but the owner, and let people from your domain join with the role you choose.
Roles per workspace
Organization and workspace roles decide who connects clouds, who sees costs and who changes settings.
An audit log
Who did what, to what and when, in your organization and each workspace, kept 180 days.
Our staff
Our team runs the service without reading your data. When a support case needs it, you decide.
Access only by your grant
Staff read your logs only with a grant your owner or an admin gives on a support case, for up to 7 days, ending with the case.
Every read listed for you
Each read, and who made it, is listed on the case and in your settings for 1 year. Addresses and emails in what we read are masked.
Emergency access, told
Emergency access is a time-limited session with a written note, and when one read your data you're told within 2 business days of its note.
Documents
What we promise, in writing, and where to see how the service is running.
What our reads cost in your cloud: cloud read costs. The permissions each connection needs: asset sources.
See it for yourself
Start a 14-day free trial, no card needed. Connect a first cloud and see everything you run in one place.