How Staxly keeps your cloud safe from Staxly

Staxly looks at your cloud and tells you what is wrong.

From connecting to a recorded fix

You trust Staxly’s sign-in. No password changes hands.
Your Azure tenant trusts a token Staxly signs, valid for 10 minutes. Staxly no longer uses any password for your cloud, and a check on every code change refuses code that would.
Staxly reads, and does not touch.
Scanning uses Azure’s read-only role. Changing anything needs a separate identity you set up and give a role to.
The record can’t be edited.
Each security fix Staxly applies is written to a log the database refuses to change or delete.

What Staxly sees, and what it never sees

Reads

The list of what you run, and how each part is configured
Who has been given access to what
Microsoft’s own security and cost recommendations
What each part costs
The activity log: who did what, and when
Only if an admin turns it on: counts of which app calls which, from app monitoring
Only if you turn logging on and let Staxly read it: answers to fixed questions about requests to your storage, such as how many used outdated encryption, and from which addresses

Never reads

Storage keys or Key Vault secrets
The contents of your files, databases or messages
Error messages, the web addresses people visit, or database queries, in your logs or monitoring data

A test runs on every change to Staxly’s code and fails if Staxly’s code asks Azure for a list of keys, secrets or passwords.

Where your records go

When you turn logging on, your records stay in your Azure, in your own log workspace. Staxly reads an answer from them when it needs one and keeps only the answer: a count, a date, and the names and addresses that appear in the record, as they appear there.

Other companies involved

Company	Why	What it receives
Anthropic	Writes plain-language summaries	Resource names, types, groups, regions, sizes, tags, costs and finding text, plus any feedback you send. Never stored configuration.
Microsoft Azure	Hosts Staxly	What Staxly stores
Resend	Sends email	Email address and the message
Stripe	Takes payment	Your billing details
GitHub	Sign-in, and pull requests if you install it

Leaving Staxly

If you disconnectDisconnecting a cloud account deletes what Staxly found about it: every part, every finding and every grouping. The record of fixes Staxly applied, and the evidence log, are kept; they do not change.

Cut us off yourself.Remove the trust or the role assignment in your tenant. Access ends, without asking us.

Certification

Staxly does not hold SOC 2, ISO 27001, PCI or HIPAA certification of its own, and its reports never give a compliance score. What it produces is evidence your auditor can use.