> For the complete documentation index, see [llms.txt](https://help.pump.co/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://help.pump.co/support/security-and-access.md). # Security & Access Pump accesses your cloud billing and usage data to optimize your spend. This page covers what Pump can and cannot access, how your data is protected, and the certifications Pump holds. **SOC 2 Type II** Pump is SOC 2 Type II certified. The audit covers security, availability, and confidentiality controls across Pump's infrastructure, data handling, and access management. Audit reports are available on request. Contact your account team or reach out through [support.pump.co](https://support.pump.co/). **What Pump accesses** Pump requires access to billing and usage data to generate savings recommendations and provide spend visibility. The specific permissions vary by cloud provider. | Provider | Access method | What Pump reads | | -------- | ---------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------- | | AWS | Cross-account IAM role (deployed via CloudFormation) | Cost Explorer data, Cost and Usage Reports, resource inventory (EC2, RDS, ElastiCache, Redshift, OpenSearch), Compute Optimizer, Pricing API | | GCP | OAuth consent + per-project service account | BigQuery billing export, project metadata, Cloud Billing account data | | Azure | Service principal (app registration + client secret) | Cost Management reports, Consumption usage details, resource groups, billing profiles | For third-party integrations (Anthropic, OpenAI, GitHub, Datadog, Cursor, ClickHouse Cloud), Pump pulls usage and cost data through each service's API using the credentials you provide. See the individual integration pages for details on what each key type accesses. **What Pump never accesses** Pump does not access your application data, source code, customer data, infrastructure configurations, secrets, or logs. Specifically: | Category | Details | | ---------------- | ----------------------------------------------------------------------------------------------------------------------------------------- | | Application data | No access to S3 bucket contents, database records, Cloud Storage objects, Azure Key Vault secrets, or any stored data | | Infrastructure | No ability to create, modify, start, stop, or terminate any cloud resource | | Identity | No access to IAM users or credentials (AWS), Active Directory users (Azure), or IAM policies (GCP) beyond the service principal Pump uses | | Logs | No access to CloudWatch Logs, Cloud Logging, or Azure Monitor logs | | Network | No access to VPC configurations, firewall rules, or network traffic | The only write action Pump performs is purchasing commitments (Reserved Instances, Savings Plans, Committed Use Discounts) when you explicitly enable Autopilot mode. Even then, Pump can only purchase discount instruments. It cannot modify or terminate any running resource. **How credentials are handled** Pump does not store your cloud provider credentials directly. | Provider | How authentication works | | -------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | AWS | Pump assumes a cross-account IAM role using temporary STS tokens. Your credentials are never stored. Each connection uses a unique External ID so only Pump can assume the role. | | GCP | OAuth tokens are used for project discovery. Per-project access is granted to a Pump-managed service account through standard GCP IAM. No Google credentials are stored. | | Azure | Pump authenticates using a service principal (app registration) with a client secret via OAuth2 client-credentials flow. The client secret is stored encrypted. | For third-party integrations, API keys you provide are stored encrypted and used only for pulling usage and cost data from the respective service. **Read-only by default** When you first connect a cloud account, Pump deploys a read-only role. This role can only read billing and usage data. It cannot make purchases or modify anything. Billing-level permissions (the ability to purchase commitments on your behalf) are granted in a separate, explicit step during onboarding. You must actively authorize Pump as your billing partner before any purchasing capability is enabled. For detailed permission lists by provider, see the connection guides: | Provider | Connection guide | | -------- | ---------------- | | AWS | Connecting AWS | | GCP | Connecting GCP | | Azure | Connecting Azure | **Data handling** Pump processes your billing and usage data to generate savings recommendations, populate dashboards, and calculate forecasts. This data is stored in Pump's infrastructure and is used exclusively for your account's optimization and visibility features. Pump does not sell, share, or provide your billing data to any third party. Your data is not used to train machine learning models or for any purpose outside of operating your Pump account. **Pump Secure (optional)** If you enable Pump Secure, an additional IAM role is deployed to your AWS account with read-only access to security-relevant services (SecurityHub, GuardDuty, CloudTrail, Macie, and resource inventory). This role is separate from the cost optimization roles and has no billing or purchasing permissions. Pump Secure scans your resource configurations against compliance frameworks (CIS, SOC 2, HIPAA, PCI DSS, NIST, and others) and reports findings. It does not perform active penetration testing, modify security groups, or change any configuration. See the Pump Secure documentation for details. **Offboarding** There are no contracts or lock-in periods. You can disconnect from Pump at any time. When you leave Pump: | What happens | Details | | -------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Existing commitments | Reserved Instances, Savings Plans, and CUDs that Pump purchased remain in your cloud account. They run off naturally on their original expiration schedule. Nothing is canceled early. | | Billing | Your billing relationship reverts to direct (you pay your cloud provider instead of Pump). | | Cloud resources | All your cloud resources, configurations, and data remain exactly as they are. Pump never modifies infrastructure. | | IAM roles | You can delete the Pump IAM roles from your AWS account, revoke the service principal in Azure, or remove IAM grants in GCP at any time. | | Pump data | Your historical cost data in Pump's dashboards is no longer accessible after disconnection. | The transition does not disrupt your workloads or require any infrastructure changes. ### Compliance certifications | Certification | Status | | ------------- | ------------------------------------------------------------------------------------------------------------------------------------------------- | | SOC 2 Type II | Certified. Report available on request. | | AWS Partner | AWS Solution Provider Program (Advanced Tier), Cloud Operations Services Competency, AI Services Competency, AWS Well-Architected Partner Program | | GCP Partner | Google Cloud Partner | | Azure Partner | Authorized Microsoft Azure Partner (CSP indirect solutions provider through Ingram Micro) | ### Questions If you have questions about Pump's security posture, data handling, or compliance certifications, contact us at or reach out to your account team. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://help.pump.co/support/security-and-access.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.