Security Overview

Manage your CloudZero organization's security and access controls.

CloudZero is designed with security at every level. All access to your cloud accounts is read-only, permissions are scoped to the minimum required, and your data is protected through industry-standard controls.

How CloudZero accesses your data

CloudZero connects to your cloud accounts using delegated access roles with read-only permissions. CloudZero accesses only the cost, usage, and metadata it needs to operate. You can review the exact permissions for each cloud provider:

• AWS permissions: Delegated access via CloudFormation with open-source IAM policies.
• Azure permissions: Read-only access to billing data via MCA, EA, or CSP agreements.
• GCP permissions: Read-only access to billing exports.

Access controls

CloudZero provides multiple layers of access control for your organization:

• Single Sign-On (SSO): Authenticate users through Okta, Microsoft Entra ID, OpenID Connect, or SAML.
• Users & Permissions: Assign Roles to control what users can see and do within CloudZero.
• Namespace Access Control: Restrict who can view and edit Dimension definitions within each namespace (preview).

Session duration

CloudZero signs users out automatically, and your organization chooses when. The web app and AI tools connected through the CloudZero Model Context Protocol (MCP) server each have their own setting:

An organization that never changes these settings keeps the defaults. Each user gets the settings of the organization they're working in.

Web app idle timeout

Any activity in the CloudZero web app resets the idle timer: moving or clicking the mouse, typing, scrolling, touching the screen, switching back to the CloudZero window, or opening another page. A user with no activity sees a warning 10 minutes before the idle timeout signs them out, and any activity during the warning keeps them signed in.

Web app sessions also end 24 hours after sign-in, even for active users. This limit is fixed, and no warning appears before it.

MCP maximum session duration

AI tools that sign in to the MCP server with a CloudZero account stay signed in until the maximum session duration has passed since sign-in. MCP sessions have no idle timeout, and activity doesn't extend them. When the maximum passes, the user signs in to CloudZero again from their AI tool.

This setting doesn't apply to API key authentication.

Change the session duration

Users with Organization Administration write permission change both settings in Settings > Organization Settings > Session Duration. For the steps, see Organization Settings.

Open sessions pick up a change without signing in again:

• Web app: the next time the user opens or reloads CloudZero. Until then, the session keeps its previous idle timeout, so a session that's idle when you save keeps the old timeout until the user returns.
• AI tools: at the tool's next token refresh, which happens at least every 2 hours while the tool is in use. A shorter maximum signs out tools whose sign-in is already older than the new maximum.