Certify Clouds

Certify Clouds automates the Azure secret lifecycle. It discovers secrets, keys, and certificates across all your Key Vaults and App Registrations, flags what's expiring, automates credential rotation with zero-downtime overlap windows, and syncs secrets to AWS and GCP for disaster recovery.

It runs as a self-hosted Docker container in YOUR Azure subscription. Your secrets never leave your environment. The only external call is license validation.

WHAT IT DOES

- Discovery: Scans every Key Vault across all connected Azure subscriptions. Surfaces secrets, certificates, and keys with expiry dates, creation dates, version history, and which applications consume them. Also scans App Registration credentials in Entra ID.

- Compliance Dashboard: Assigns a compliance score to your secret estate based on expiry policy, rotation frequency, key size, and algorithm standards. Filterable by subscription, vault, and secret type.

- Alerts: Configurable email and webhook notifications when secrets approach expiry thresholds (30, 14, 7 days). Scheduled daily or weekly digests.

- Rotation (Pro): Automated rotation for App Registration client secrets and certificates. Creates new credentials, stores them in Key Vault, propagates to consuming App Services, Functions, and Container Apps, verifies the rollover, then disables the old credential. Zero-downtime overlap windows are configurable per secret.

- Multi-Cloud Sync (Pro): Replicates selected Azure Key Vault secrets to AWS Secrets Manager and GCP Secret Manager. Keeps them in sync on every rotation. Supports regex-based secret selection.

- Asset Dependencies (Pro): Maps which Azure resources (App Services, Functions, SQL Servers, Container Apps) consume each Key Vault secret. When you rotate, you see exactly what gets affected.

- Audit Log: Every action (scan, rotation, sync, configuration change) is logged with actor, timestamp, and outcome. Exportable for compliance reporting.

DEPLOYMENT

Certify Clouds runs as a Docker container. Deploy to Azure Container Instances, Azure Container Apps, or any Docker host in your network. Setup takes 10 minutes. Uses Azure RBAC with minimal permissions. Discovery reads metadata only (names, expiry dates, properties), never actual secret values.

TIERS

- Starter (GBP 49/month): Discovery, compliance dashboard, alerts, audit log, up to 4 subscriptions, single user. 30-day free trial.

- Pro (GBP 299/month): Everything in Starter plus automated rotation, multi-cloud sync, asset dependencies, SSO/SAML, B2C tenant scanning, unlimited subscriptions, multi-user. 30-day free trial.

- Enterprise: Custom pricing for regulated industries with dedicated support and custom contracts.

REQUIREMENTS

- An Azure subscription with Key Vaults to scan

- Docker host (Azure Container Instances, Container Apps, or any Docker-compatible environment) - with its own delegated subnet

- PostgreSQL database - with its own delegated subnet

- Azure RBAC roles: Key Vault Reader for discovery, additional roles for rotation

SUPPORT

Documentation: https://docs.certifyclouds.com

Email: support@certifyclouds.com

Website: https://certifyclouds.com/support