Skip to content

CertifyClouds Documentation

Azure secret lifecycle platform for discovering, rotating, and syncing your cloud secrets, keys, and certificates.

  • Quick Start

    Deploy CertifyClouds and run your first scan

  • Features

    Scan, compliance evidence, alerts, rotation and sync

  • API Reference

    REST API documentation

  • Support

    FAQ and troubleshooting guides

What is CertifyClouds?

CertifyClouds is a secret lifecycle platform that helps organisations:

  • Discover all secrets, keys, and certificates across Azure Key Vaults
  • Monitor expiration dates, compliance posture, and Enterprise Application credentials, including active SAML signing certificates and owners
  • Alert teams before credentials expire
  • Rotate App Registration secrets automatically (PRO + ENTERPRISE)
  • Sync secrets to AWS and GCP (PRO + ENTERPRISE)

Architecture

┌─────────────────────────────────────────────────────────────────┐
│                     Your Azure Environment                       │
├─────────────────────────────────────────────────────────────────┤
│                                                                  │
│  ┌──────────────┐    ┌──────────────┐    ┌──────────────┐       │
│  │  Key Vault   │    │  Key Vault   │    │  Key Vault   │       │
│  │  (Prod)      │    │  (Dev)       │    │  (Staging)   │       │
│  └──────────────┘    └──────────────┘    └──────────────┘       │
│         │                   │                   │                │
│         └───────────────────┼───────────────────┘                │
│                             │                                    │
│                    ┌────────▼────────┐                          │
│                    │  CertifyClouds  │                          │
│                    │  ┌────────────┐ │                          │
│                    │  │ Scan       │ │                          │
│                    │  │ Compliance │ │                          │
│                    │  │ Alerts     │ │                          │
│                    │  │ Rotation*  │ │                          │
│                    │  │ Sync*      │ │                          │
│                    │  └────────────┘ │                          │
│                    └─────────────────┘                          │
│                                                                  │
└─────────────────────────────────────────────────────────────────┘
                              * PRO and ENTERPRISE tiers

Licence Tiers

Feature STARTER PRO ENTERPRISE
Key Vault Scan
Compliance Scoring
Alerts & Notifications
Audit Logging
Max Subscriptions 4 20 21+ / agreed scope
Users 1 Unlimited Unlimited
Secret Rotation 3/month
Multi-Cloud Sync
Dependency Mapping
SSO / OIDC
External Tenant Registry
Commercial Terms Standard Standard MSA/DPA + support schedule

Compare licence tiers

Getting Started

1. Deploy CertifyClouds

Deploy to Azure Container Apps or Azure Container Instances:

./deploy-certifyclouds-cae.sh \
  --name prd \
  --location uksouth \
  --acr-name YOUR_ACR \
  --container-apps-subnet /subscriptions/.../subnets/snet-cae \
  --postgres-subnet /subscriptions/.../subnets/snet-psql

On a new install the deploy stops before CertifyClouds starts and prints the access command for step 2, with the managed identity's principal ID filled in.

Installation Guide

2. Configure Azure Permissions

Grant CertifyClouds read access to your Key Vaults with the command the deploy printed, then run the same deploy command again to start CertifyClouds:

./setup-certifyclouds-access.sh --principal-id $PRINCIPAL_ID --subnet-id $APP_SUBNET_ID --apply

Azure Permissions

3. Run Your First Scan

  1. Add your Azure subscriptions in Settings > Subscriptions
  2. Click Run Scan in the Assets tab
  3. Review discovered secrets, keys, and certificates
  4. Check your compliance score

Quick Start Guide

Support