Identity & access
Access starts with your identity provider. We integrate Google Workspace / Cloud Identity, Microsoft Entra ID, and Okta, using SAML or OpenID Connect where supported. Group-based roles, multifactor authentication, and deliberate onboarding and offboarding make access accountable.
- Scoped permissions: Least-privilege cloud IAM and Kubernetes RBAC, with separate human and workload identities.
- Workload credentials: Short-lived credentials and workload identity in place of long-lived keys where supported.
- Private administration: Identity-based private access with tools such as Tailscale, with policies that limit who can reach each resource.
- Access reviews: Role assignments, provisioning and removal records, and reviews your team can maintain.
CloudKite access is scoped and removable. Your organization owns the accounts, retains administrative access, and controls the infrastructure code and state.
Secrets in the right place
Credentials stay out of source code and container images. We integrate workloads and delivery pipelines with your chosen secret manager, with access policies and rotation appropriate to the system.
| Secret store | Where it fits |
|---|---|
| Google Cloud Secret Manager | Secrets for Google Cloud applications and automation. |
| AWS Secrets Manager | Managed secrets for AWS workloads and rotation workflows. |
| Azure Key Vault | Azure secrets management with identity-based access controls. |
| 1Password | Team credential management and secrets automation. |
Secure delivery & operations
Security controls need to work during a deployment, an incident, and an ordinary day of engineering. We build them into the platform and the practices around it.
Reviewable changes
Infrastructure as code, pull-request approvals, and deployment histories make changes traceable. Dependency and image scanning, a defined patching process, and tracked remediation help your team manage vulnerabilities over time.
Protected systems
Network segmentation, private administrative access, and encryption in transit and at rest help protect the platform. We choose and document controls around your architecture, data, and operational requirements.
Prepared operations
Centralized audit logs, actionable alerts, and documented incident procedures give your team a way to detect and respond to problems. Backup configuration, restore exercises, and recovery runbooks support continuity and provide evidence of the work.
Agent workload security
Agents can execute code, call tools, and act on data. We help define and enforce the boundaries around that work, alongside the reliability and delivery practices the platform needs.
- Execution boundaries: Isolated environments, scoped filesystem access, and resource limits chosen for the workload.
- Controlled connections: Network egress policies and deliberate access to model APIs, business tools, and approved data sources.
- Limited authority: Scoped workload credentials and authorization enforced by the infrastructure and connected tools.
- Approval points: Review steps for sensitive actions, designed into the workflow.
- Operational visibility: Execution traces, usage monitoring, and audit events, with logging and retention designed around your data requirements.
These choices follow practical principles such as limiting tool permissions and enforcing authorization outside the model, described in OWASP’s guidance on excessive agency.
Explore our agent infrastructure services for the wider production architecture.
SOC 2 support
We help clients turn SOC 2 requirements into working infrastructure controls and maintainable evidence. We work with your compliance lead and independent auditor to agree on scope, responsibilities, and the evidence your program needs.
| Control area | Implementation and evidence we help maintain |
|---|---|
| Access management | SSO, role assignments, access reviews, and records of provisioning and removal. |
| Change management | Pull-request approvals, infrastructure plans, and deployment histories. |
| Monitoring and response | Centralized audit logs, alert routing, incident records, and response runbooks. |
| System protection | Secret management, encryption configuration, vulnerability findings, and remediation records. |
| Recovery and continuity | Backup configuration, restore exercises, and documented recovery procedures. |
The goal is a repeatable operating practice that supports your SOC 2 examination and continues through everyday engineering work. Infrastructure configuration, records, and operational knowledge stay in systems your organization controls.
Access management in practice
With the Miami Marlins, CloudKite helped standardize roles and access workflows as part of a broader cloud and ML platform engagement. Least-privilege access, multifactor authentication, and automated reviews helped make onboarding predictable.
The Marlins team reported that adding a new employee took less than 30 minutes, giving new hires a faster path to productive work.
Read the Miami Marlins case study.
Working with your team
We start with your architecture, existing controls, and the requirements your team needs to meet. Together, we agree on the gaps to address, the implementation work, and who will own each practice.
Your engineers work alongside us as we build and document the controls. Runbooks, architecture decisions, and working sessions help your team operate the platform independently. Ongoing support can cover security maintenance, operational improvements, and the infrastructure evidence your compliance program needs.