Your VPC. Your Data.
No Exceptions.
Cloud Spectra runs entirely inside your AWS account. No traffic leaves your network, no telemetry phones home, no third-party agents on your instances.
Every security property is enforced by AWS infrastructure you already own -- not by trusting Cloud Spectra.
Runs in Your VPC
The gateway is an EC2 instance running inside your AWS account and VPC. All traffic flows through your network. Cloud Spectra has zero infrastructure in the data path. Your packets never touch a Cloud Spectra-operated server. Customer traffic, configuration, and logs never leave the AWS region you deploy into, and Cloud Spectra stores no customer data -- so the product introduces no cross-border data transfer of its own.
No Callbacks Home
Zero telemetry. No usage data, diagnostics, or analytics are sent to Cloud Spectra. License validation is offline -- enforced by the AMI itself, not by a licensing server. No outbound connections are required beyond your normal internet traffic.
Config in Your SSM
All gateway configuration is stored in AWS Systems Manager Parameter Store in your account under the /CloudSpectra/ path. You own it, you control it, you can read and modify it with the standard AWS CLI at any time. Cloud Spectra has no access to your SSM.
Logs in Your CloudWatch
All metrics, firewall alerts, API audit logs, and NAT flow logs are written to CloudWatch in your account. Cloud Spectra cannot access your CloudWatch data. You retain, export, or delete logs under your own retention policies.
The gateway EC2 instance uses an IAM role scoped to its specific stack resources by tag and ARN. No wildcard resource permissions.
The CloudFormation stack creates a purpose-built IAM instance profile during deployment. Every permission is tightly scoped: EC2 actions are gated by resource tag matching your stack name, Route53 actions are gated by the hosted zone ARN, and SSM access is restricted to the /CloudSpectra/ parameter path.
Cross-account transit access -- when enabled -- uses a separate IAM role with a trust policy explicitly listing the hub account ID. No implicit trust, no wildcards.
cfn-lint, AWS IAM Access Analyzer, or your own tooling before you deploy. No hidden policies applied post-deployment.
- EC2 describe + modify network interfaces and Elastic IPs -- scoped to resources tagged with your stack name
- Route53 ChangeResourceRecordSets -- scoped to your hosted zone ARN only
- SSM GetParameter / PutParameter -- scoped to
/CloudSpectra/*path prefix - CloudWatch PutMetricData -- no resource restriction (required by AWS)
- EC2 DescribeInstances, DescribeRegions -- read-only fleet awareness
- ACM ExportCertificate -- scoped to the stack certificate ARN
- STS AssumeRole for cross-account transit -- scoped to explicitly listed spoke role ARNs (optional, AI Gateway tier)
Three independent audit streams, all written to CloudWatch in your account, all accessible via standard AWS tooling.
API Audit Log
Every REST API call to the gateway management API is logged with timestamp, source IP, HTTP method, endpoint, authenticated user, and response code. Logs are written as structured JSON to CloudWatch Logs.
"time": "2026-06-06T14:22:01Z",
"user": "admin",
"src": "10.0.1.42",
"method": "PUT",
"path": "/api/firewall/rules",
"status": 200
}
Firewall Events
Suricata IDS/IPS alerts and nftables rule hits are written in EVE JSON format and forwarded to CloudWatch. Each event includes rule ID, category, source/destination, protocol, and action taken (alert vs. drop).
"event_type": "alert",
"src_ip": "203.0.113.5",
"dest_port": 22,
"signature": "SSH brute force",
"action": "blocked"
}
AI Proxy Log
Every LLM API call proxied through the gateway is logged with model name, token count, estimated cost, source IP, and latency. Prompt content is never logged. All entries go to CloudWatch in your account.
"model": "gpt-4o",
"src": "10.0.2.17",
"tokens_in": 512,
"tokens_out": 1024,
"est_cost_usd": 0.0092,
"cache_hit": false
}
The data-plane components are kernel-level open source that you can inspect, build, and audit independently. No proprietary packet inspection, no black-box agents.
Packet processing happens entirely in Linux kernel space via nftables and IPVS -- no userspace packet copies, no proprietary kernel modules. The gateway binary orchestrates configuration; it never intercepts or copies packet payloads in user space.
TLS private keys are generated and stored entirely within your EC2 instance. No key escrow, no cloud-side storage.
ACM Private CA issues the certificate
Your ACM Private CA (created by the CloudFormation stack in your account) signs the gateway certificate. The CA private key never leaves ACM.
ExportCertificate to instance disk only
The gateway calls acm:ExportCertificate at boot and writes the certificate and private key to local disk. The API call happens instance-to-AWS -- the key never transits Cloud Spectra infrastructure.
HAProxy reads the key locally for TLS termination
HAProxy is configured to read the certificate file from disk with 0600 permissions, accessible only to root. TLS is terminated locally on the instance for dashboard and API traffic.
The private key is never:
We are honest about where we are. Cloud Spectra LLC does not hold third-party security certifications today -- and we will never claim one we do not have.
Because the appliance runs entirely inside your AWS account, your deployment inherits the certifications of your own AWS environment for the underlying infrastructure -- AWS data centers are independently audited (SOC 1/2/3, ISO 27001, PCI DSS, FedRAMP, and more). Cloud Spectra adds no out-of-account data path that would sit outside those boundaries.
For the Cloud Spectra organization itself, our certification roadmap is below. We are happy to walk security teams through our control mapping and share current timelines under NDA.
- SOC 2 Type II -- in planning; control mapping available on request
- ISO 27001 -- practices aligned; certification under evaluation
- GDPR / UK GDPR -- addressed via our Privacy Policy and DPA (SCCs / UK IDTA)
- CCPA / CPRA -- we act as a service provider; we do not sell or share personal data
- HIPAA BAA -- not offered at this time
- AWS shared responsibility -- infrastructure controls inherited from your AWS account
Strong defaults for data in motion and at rest -- all enforced by AWS primitives and standard, auditable open source.
In Transit
Dashboard and management API traffic is terminated over TLS 1.2+ by HAProxy on the instance. Calls the gateway makes to AWS APIs (SSM, ACM, Route53, CloudWatch, EC2) use AWS SDK TLS. Private keys are generated and stored only on your instance -- see Keys Never Leave Your Instance above.
At Rest
Secrets and configuration are stored as SSM SecureString parameters encrypted with AWS KMS in your account. The admin dashboard password is stored only as a bcrypt hash. EBS volumes can be deployed with encryption enabled, and all logs land in your own KMS-capable CloudWatch.
We bundle well-known open-source data-plane components -- and we take responsibility for keeping them current.
The appliance ships nftables, IPVS, Suricata, HAProxy, Squid, WireGuard, and Kubernetes-ecosystem tooling. We monitor published CVEs for these components and rebuild the AMI on a regular cadence, with expedited rebuilds for critical vulnerabilities. Suricata threat signatures (ET Open ruleset) update on the instance independently of AMI releases.
A per-release component and version list (software bill of materials) is available to customers and prospects on request, so your security team can map our dependencies to their own CVE tooling.
- CVE monitoring -- for all bundled OSS components
- Scheduled AMI rebuilds -- routine patch cadence
- Expedited critical-CVE turnaround -- out-of-band AMI releases
- Suricata ET Open signatures -- updated on the instance
- SBOM per release -- available on request
The product runs in your account and sends us no telemetry. These providers support our website and sales process only. Full detail lives in the Privacy Policy.
| Provider | Purpose | Where |
|---|---|---|
| Amazon Web Services | Marketplace billing & software distribution | USA |
| Cloudflare, Inc. | DNS, CDN, edge security, cost-scanner worker | USA / global edge |
| GitHub, Inc. | Static website hosting (Pages) | USA |
| Calendly, LLC | Meeting scheduling (after consent / on interaction) | USA |
Found a security issue in Cloud Spectra? We want to hear from you, and we will not pursue legal action against good-faith research.
Report vulnerabilities to security@CloudSpectra.Ai. Please include enough detail to reproduce the issue, and give us a reasonable window to remediate before any public disclosure. Our machine-readable policy lives at /.well-known/security.txt (RFC 9116).
Safe harbor. If you make a good-faith effort to comply with this policy during your research, we will consider it authorized, will work with you to understand and resolve the issue quickly, and will not recommend or pursue legal action related to your research.
- Contact -- security@CloudSpectra.Ai
- Policy -- /.well-known/security.txt
- Triage target -- acknowledgement within 3 business days
- Coordinated disclosure -- we credit reporters who want recognition
Cloud Spectra eliminates metered charges on the traffic that flows through it -- the per-GB tax on network bytes and the per-token tax on AI calls. We are deliberately a data-plane appliance, and we are clear about what that does not include.
An inline appliance does not, and cannot, rightsize your instances, bid on spot for your fleet, or manage Savings Plans and Reserved Instances -- those are control-plane scheduling problems handled by a different class of tool. We replace the data plane; we are not your compute cost optimizer. That focus is why our networking savings are verifiable on your own AWS Cost Explorer against published AWS per-GB rates, not estimated in a model.
Ready to Deploy?
Schedule a call to walk through the architecture, or go straight to pricing. No sign-up required to start.