Security & Access
We are committed to the highest standard of security, which is why...
Pump accesses your cloud billing and usage data to optimize your spend. This page covers what Pump can and cannot access, how your data is protected, and the certifications Pump holds.
SOC 2 Type II
Pump is SOC 2 Type II certified. The audit covers security, availability, and confidentiality controls across Pump's infrastructure, data handling, and access management. Audit reports are available on request. Contact your account team or reach out through support.pump.co.
What Pump accesses
Pump requires access to billing and usage data to generate savings recommendations and provide spend visibility. The specific permissions vary by cloud provider.
AWS
Cross-account IAM role (deployed via CloudFormation)
Cost Explorer data, Cost and Usage Reports, resource inventory (EC2, RDS, ElastiCache, Redshift, OpenSearch), Compute Optimizer, Pricing API
GCP
OAuth consent + per-project service account
BigQuery billing export, project metadata, Cloud Billing account data
Azure
Service principal (app registration + client secret)
Cost Management reports, Consumption usage details, resource groups, billing profiles
For third-party integrations (Anthropic, OpenAI, GitHub, Datadog, Cursor, ClickHouse Cloud), Pump pulls usage and cost data through each service's API using the credentials you provide. See the individual integration pages for details on what each key type accesses.
What Pump never accesses
Pump does not access your application data, source code, customer data, infrastructure configurations, secrets, or logs. Specifically:
Application data
No access to S3 bucket contents, database records, Cloud Storage objects, Azure Key Vault secrets, or any stored data
Infrastructure
No ability to create, modify, start, stop, or terminate any cloud resource
Identity
No access to IAM users or credentials (AWS), Active Directory users (Azure), or IAM policies (GCP) beyond the service principal Pump uses
Logs
No access to CloudWatch Logs, Cloud Logging, or Azure Monitor logs
Network
No access to VPC configurations, firewall rules, or network traffic
The only write action Pump performs is purchasing commitments (Reserved Instances, Savings Plans, Committed Use Discounts) when you explicitly enable Autopilot mode. Even then, Pump can only purchase discount instruments. It cannot modify or terminate any running resource.
How credentials are handled
Pump does not store your cloud provider credentials directly.
AWS
Pump assumes a cross-account IAM role using temporary STS tokens. Your credentials are never stored. Each connection uses a unique External ID so only Pump can assume the role.
GCP
OAuth tokens are used for project discovery. Per-project access is granted to a Pump-managed service account through standard GCP IAM. No Google credentials are stored.
Azure
Pump authenticates using a service principal (app registration) with a client secret via OAuth2 client-credentials flow. The client secret is stored encrypted.
For third-party integrations, API keys you provide are stored encrypted and used only for pulling usage and cost data from the respective service.
Read-only by default
When you first connect a cloud account, Pump deploys a read-only role. This role can only read billing and usage data. It cannot make purchases or modify anything.
Billing-level permissions (the ability to purchase commitments on your behalf) are granted in a separate, explicit step during onboarding. You must actively authorize Pump as your billing partner before any purchasing capability is enabled.
For detailed permission lists by provider, see the connection guides:
AWS
Connecting AWS
GCP
Connecting GCP
Azure
Connecting Azure
Data handling
Pump processes your billing and usage data to generate savings recommendations, populate dashboards, and calculate forecasts. This data is stored in Pump's infrastructure and is used exclusively for your account's optimization and visibility features.
Pump does not sell, share, or provide your billing data to any third party. Your data is not used to train machine learning models or for any purpose outside of operating your Pump account.
Pump Secure (optional)
If you enable Pump Secure, an additional IAM role is deployed to your AWS account with read-only access to security-relevant services (SecurityHub, GuardDuty, CloudTrail, Macie, and resource inventory). This role is separate from the cost optimization roles and has no billing or purchasing permissions.
Pump Secure scans your resource configurations against compliance frameworks (CIS, SOC 2, HIPAA, PCI DSS, NIST, and others) and reports findings. It does not perform active penetration testing, modify security groups, or change any configuration. See the Pump Secure documentation for details.
Offboarding
There are no contracts or lock-in periods. You can disconnect from Pump at any time.
When you leave Pump:
Existing commitments
Reserved Instances, Savings Plans, and CUDs that Pump purchased remain in your cloud account. They run off naturally on their original expiration schedule. Nothing is canceled early.
Billing
Your billing relationship reverts to direct (you pay your cloud provider instead of Pump).
Cloud resources
All your cloud resources, configurations, and data remain exactly as they are. Pump never modifies infrastructure.
IAM roles
You can delete the Pump IAM roles from your AWS account, revoke the service principal in Azure, or remove IAM grants in GCP at any time.
Pump data
Your historical cost data in Pump's dashboards is no longer accessible after disconnection.
The transition does not disrupt your workloads or require any infrastructure changes.
Compliance certifications
SOC 2 Type II
Certified. Report available on request.
AWS Partner
AWS Solution Provider Program (Advanced Tier), Cloud Operations Services Competency, AI Services Competency, AWS Well-Architected Partner Program
GCP Partner
Google Cloud Partner
Azure Partner
Authorized Microsoft Azure Partner (CSP indirect solutions provider through Ingram Micro)
Questions
If you have questions about Pump's security posture, data handling, or compliance certifications, contact us at support@pump.co or reach out to your account team.
Last updated
Was this helpful?