Your AWS account stays yours

No. The role you deploy uses the AWS-managed ViewOnlyAccess and SecurityAudit policies plus read access to billing. It has no permission to create, change, start, stop or delete anything. This is not a promise in our code: AWS itself refuses any write call from the role. Your team applies the recommendations you choose.

No. The role does not have s3:GetObject, so AWS will not let it download or open any object, and Citadel AI never lists or reads your objects.

What we see is the bucket's configuration (encryption, public access, versioning, lifecycle rules, logging) and its size and object count, which AWS publishes as CloudWatch metrics. That is enough to find lifecycle and storage-class savings without touching your data.

No. Citadel AI reads metadata: which databases exist, their instance class, engine version, storage and utilization metrics such as CPU and connections. The role grants no access to database contents, queue messages or secret values. For a secret we only see when it was last used, to tell you whether you still pay for one nobody reads.

• Resource inventory: ids, names, tags and settings of your EC2, RDS, S3, Lambda and 40+ other services.
• Utilization metrics from CloudWatch, such as CPU, connections and traffic over the last 30 days.
• Billing totals from Cost Explorer, plus your Savings Plans and Reserved Instances.
• AWS's own recommendations from Cost Optimization Hub and Compute Optimizer, when you have them switched on.
• Security settings for the Security module: MFA, password policy, public access, encryption flags, CloudTrail and GuardDuty status.

We never ask for or store access keys, and there is no agent to install. Citadel AI asks AWS STS for temporary credentials to the role you created. They expire after one hour at most and are never written to disk.

Each customer has a unique ExternalId that the role requires. Citadel AI refuses to use a role that would let it in without one, so nobody else can point Citadel AI at your account.

Yes. Every call Citadel AI makes is recorded in your own AWS CloudTrail under the CitadelReadOnly role, with the time, the API action and the source. You can audit it with the tools you already use, without asking us.

Delete the CloudFormation stack (or run terraform destroy). The role disappears and access ends that second; credentials already issued stop working within the hour. Removing the account in Citadel AI also deletes everything we stored about it.

Your data stays on AWS. Citadel AI runs on AWS in the EU (Frankfurt, eu-central-1): the application, the database and its backups. We use no other cloud and no third-party data warehouse or analytics service for your AWS data.

Card payments go through Paddle, our Merchant of Record, which never receives your AWS data.

Yes, everywhere. Traffic between your browser, Citadel AI and AWS uses TLS. The database and its backups are encrypted at rest with AWS-managed keys.

Passwords are stored only as a one-way scrypt hash, and sign-in sessions are stored hashed too, so a copy of the database would not let anyone sign in. Repeated wrong passwords lock the sign-in for a while.

No. Every record is tied to your organization, and every query the application runs is limited to the organization you are signed in to. We test this on every release: an automated test signs in as one customer and tries to open, list and change another customer's data through every part of the product, and the release fails if anything comes back.

Only a small team, and only to help you, for example when you ask a question about a recommendation. Every such access is recorded in an audit log with who, when and what. Support sessions that act as your user end automatically after one hour.

The team works from the Republic of Moldova. Your data stays stored in the EU; access from outside the EU is covered by the safeguards in our Privacy Notice.

• Detailed resource-level costs: 90 days. Daily cost totals: 12 months.
• Removing an AWS account in Citadel AI deletes its data at once.
• When you close your account, we delete your data within 30 days; encrypted backups are overwritten within a further 35 days.

No. Your inventory, metrics and billing data are used only to produce your recommendations and findings. We do not sell them, share them with other customers or use them to train AI models.

On Amazon Bedrock, inside AWS, in EU regions only. Your questions and the answers never go to an AI provider's own servers. AWS does not use Bedrock prompts or answers to train models and does not share them with the model providers.

It can only call read-only tools that run the same queries as your dashboard, limited to your organization by the application, never by the AI. It cannot change anything in Citadel AI or in AWS, and it cannot see another customer's data. Every question and answer is kept in your organization's history.

Yes. The assistant is a separate module that is switched on per organization. Tell us and we will switch it off for yours.

Yes. Each person has a role in your organization: Admin manages people and settings, Engineer also connects and removes AWS accounts, Member works with recommendations and findings. Only admins invite or remove people, and an organization always keeps at least one admin.

Not yet. Sign-in is by email and password today. Sign-in with Google and single sign-on through your identity provider (OIDC, then SAML) are on our roadmap.

Citadel AI is built by a founder who studied information security and holds five AWS certifications, including AWS Certified Security Specialty. Security is where Citadel AI started, not something added later.

Not yet. Citadel AI is a young product and the audits are planned. We already build and run it along the controls those standards ask for: least-privilege read-only access, encryption in transit and at rest, isolation between customers tested on every release, audit logs of every staff access, role-based access for your team, and clear retention and deletion rules.

Until the audits are done we answer security questionnaires, share the full role template before you deploy it, and walk your security team through the setup. Write to andrei@code-nex.tech.

Yes. The CloudFormation template and the Terraform module are plain text you can read, diff and run through your own policy checks before anything is created. Nothing in them is hidden or downloaded at deploy time.

Email andrei@code-nex.tech with the details. We reply within two business days and keep you updated until it is fixed.