Glossary¶

Product Terms¶

Assets¶

Scan (Key Vault Scan): scans Azure Key Vaults across subscriptions to inventory secrets, keys, and certificates. Tracks expiration dates and provides a centralised view of all vault contents.

Dependencies (PRO + ENTERPRISE): maps Azure Key Vault credentials to dependent Azure resources for impact analysis and coordinated credential rotation.

Automation¶

Rotation: rotates credentials for Azure App Registrations. Matches app registration secrets to their Key Vault locations and performs one-click rotation. STARTER includes 3 manual rotations a month; PRO and ENTERPRISE have no limit.

Sync (PRO + ENTERPRISE): copies Azure Key Vault secrets and certificates to AWS and GCP for disaster recovery and multi-cloud deployments.

Metadata-only access¶

The Scan reads names, expiry dates, and configuration, never secret values. Rotation and Sync handle secret values in memory while they run, and CertifyClouds never stores them.

Licence Terms¶

STARTER Tier¶

Entry-level licence tier. Includes:

• Key Vault Scan
• Compliance scoring
• Alert notifications
• Audit logging
• Maximum 4 subscriptions
• Single user

PRO Tier¶

Full-feature licence tier. Includes everything in STARTER plus:

• Rotation with no monthly limit
• Sync
• Dependencies
• Up to 20 subscriptions
• Multi-user support
• SSO/OIDC integration

Licence Key¶

A key in the form CC-XXXXXXXX-XXXXXXXX-XXXXXXXX that activates CertifyClouds. The licence server checks it and returns your organisation name, tier, expiration date, and subscription limits.

Azure Terms¶

Key Vault¶

Azure's cloud service for securely storing and accessing secrets, keys, and certificates. CertifyClouds monitors and manages Key Vault contents but does not replace the vault itself.

App Registration¶

Microsoft Entra ID identity for applications. App Registrations have secrets (passwords) or certificates for authentication. Rotation rotates these credentials.

Enterprise Application¶

The Microsoft Entra service principal that represents an application in a tenant. CertifyClouds monitors its secrets, non-SAML certificates, SAML token-signing certificates, and owners, but does not rotate them. See Enterprise Applications (monitor-only).

Managed Identity¶

Azure's recommended authentication method for cloud workloads. CertifyClouds uses managed identity when deployed in Azure, eliminating the need for stored credentials.

Service Principal¶

Microsoft Entra identity that represents an application in a tenant. The Enterprise Applications view in Entra exposes service principals; see Enterprise Application.

Subscription¶

Azure billing and resource container. The Scan runs across multiple subscriptions based on licence tier limits.

Compliance Terms¶

Compliance Score¶

Percentage score (0-100) indicating how well secrets follow security best practices. Based on expiration status, age, and naming conventions.

Compliance Rule¶

Configurable policy for evaluating secret health. Examples: "Secrets must expire within 90 days", "No secrets older than 365 days".

Violation¶

A secret failing one or more compliance rules. Violations are categorised by severity (critical, high, medium, low).

Operational Terms¶

Scan¶

The Key Vault Scan: reads secret, key, and certificate metadata from Key Vaults across configured subscriptions. Results are stored for historical comparison.

Rotation¶

Automation operation that generates a new secret or certificate for an App Registration and updates the corresponding Key Vault entry.

Sync¶

Automation operation that copies an Azure Key Vault secret to AWS or GCP. Only syncs the current value, not version history.

Discovery¶

App Registration discovery: a rotation operation that finds App Registrations and matches them to Key Vault secrets. Prerequisite for rotation. It does not refer to the Key Vault Scan.

Dependency Mapping¶

Dependencies operation that analyses Azure resources to find references to Key Vault credentials.

Blast Radius Analysis¶

Dependencies operation that calculates the impact of rotating a specific credential. Shows all dependent resources.

Full-Stack Rotation¶

Dependencies operation that rotates a credential AND automatically updates all dependent Azure resources.

Exclusion¶

Rule preventing specific secrets from being synced or rotated. Useful for legacy systems or sensitive credentials.

Status Terms¶

Healthy¶

Secret with valid expiration date well into the future (typically 30+ days).

Expiring¶

Secret approaching expiration (typically within 30 days). Triggers warnings and alerts.

Expired¶

Secret past its expiration date. Critical status requiring immediate action.

Pending¶

Operation queued but not yet started.

In Progress¶

Operation currently executing.

Completed¶

Operation finished successfully.

Failed¶

Operation encountered an error. Details in audit log.

Abbreviations¶