Security & Compliance¶
Data Protection & Encryption¶
How is my data encrypted?
Your data is stored in a dedicated, logically separated AWS account and is encrypted at rest using AWS Key Management Service (KMS) keys dedicated to your environment. Data in transit is encrypted using TLS 1.2 or higher. Because each customer runs in a separate AWS account, encryption keys are isolated from other customers.
What is a KMS key and what does it do?
AWS Key Management Service (KMS) is AWS's managed encryption-key service. A KMS key is used to encrypt data at rest — for Nautobot Cloud that includes your database, its backups, and file storage. Network to Code manages these keys on your behalf as part of the managed service, and the underlying data cannot be read without them.
Is my database redundant as well as encrypted?
Yes. Your database is encrypted at rest and runs as a redundant, multi-node cluster spread across multiple AWS Availability Zones.
Who provides the TLS certificates?
TLS certificates are provisioned and managed by the Network to Code Cloud team as part of the service.
Are passwords and secrets rotated?
Yes. Service-account passwords are rotated automatically, and database connections use short-lived (ephemeral) credentials rather than static passwords.
Where are secrets and credentials stored, and how are they handled?
Secrets and sensitive credentials are stored in an internal vaulting service that is logically separated per customer, and each instance has its own database credentials. Nautobot Cloud also includes a built-in Secrets capability you can use instead of running your own secrets store, and it integrates with Nautobot's Secret Providers so values can be retrieved at runtime (for example, when Golden Config connects to a device). Many customers keep their existing vault and use Nautobot Cloud Secrets only to store the minimal credentials needed to reach it — retaining full ownership of their secrets lifecycle. See the Secrets FAQ and Manage Secrets.
Access Control & Identity¶
Does Nautobot Cloud support role-based access control (RBAC)?
Yes. Within a Nautobot instance, access control is fully customizable — you define roles and permissions just as you would for a self-hosted Nautobot, and you retain full control over how permissions are assigned. Note that instance-level RBAC is separate from access to the Cloud Console itself.
Is there any direct database access?
No. Direct database access is not provided; all access is strictly controlled and uses short-lived credentials.
Do customers have access to the Nautobot Cloud code?
No. Nautobot Cloud — including the Cloud Console and the platform that operates it — is a SaaS offering, and its code is proprietary to Network to Code. Access to any custom application code built specifically for you is governed by your contract.
How do I log in to the Cloud Console, and is SSO supported?
The Cloud Console supports single sign-on through your identity provider, brokered by Nautobot Cloud. Console access is default-closed: users must be explicitly added to your Organization with a role, which is done by submitting a support request (see Users & Support). At this time, Console access cannot be scoped by identity-provider group membership. (Group synchronization is available for your Nautobot instances — see below.)
Can I use my own identity provider for my Nautobot instances?
Yes. For your Nautobot instances you can configure Google, GitHub, Microsoft Entra ID, Okta, or a generic OIDC provider through the Cloud Console, and synchronize identity-provider groups into Nautobot. The permissions attached to those groups are defined within Nautobot rather than inferred from your identity provider. See Single Sign-On (SSO).
Does Nautobot Cloud need IAM roles in my AWS account?
No — the Nautobot Cloud environment operates independently of your own cloud accounts. If you later want Nautobot to manage resources inside your cloud (for example, discovering resources or making API changes), any required IAM permissions are specific to that use case. For AWS network connectivity such as Transit Gateway peering, IAM roles are generally not required; Network to Code provides a customer-specific AWS account ID that you use to share the necessary network resources.
Compliance & Auditing¶
Is Nautobot Cloud SOC 2 compliant?
Yes. Nautobot Cloud has completed a SOC 2 audit, and independent penetration tests are performed annually to validate ongoing security. You can review our current compliance status and request reports on the Network to Code Trust Center.
How are logs handled, and can I access them?
You can view your instances' logs directly in the Cloud Console under Data Insights Logs, or from the Logs tab on a specific instance's page. Within Nautobot itself, the UI also surfaces platform and application events such as job results and change logs. To integrate with your own tooling, you can forward an instance's logs to a Syslog collector or SIEM — see Syslog Forwarding.
How are vulnerabilities and dependencies managed?
Nautobot Cloud is built on the Django framework. Dependencies and open-source packages are actively monitored; critical vulnerabilities are patched as quickly as possible, and lower-severity issues are addressed during regular platform updates. Platform images are pulled from trusted registries.
Data Handling & Privacy¶
Which third parties does Nautobot Cloud rely on?
Nautobot Cloud is hosted on AWS and relies on a defined set of third-party service providers to deliver and operate the service. For the current list of subprocessors and our data-processing details, see the Network to Code Trust Center or contact your account team.
What happens to my data if my subscription ends?
You can capture a full backup of your data at any time during your subscription by creating a Snapshot — see Backup & Restore. Data retention and how to retrieve your data after a subscription ends are governed by your subscription agreement; contact support for specifics.
Are AI features (e.g. NautobotGPT) enabled by default?
No. AI features are disabled by default. Generative AI is available only through the opt-in NautobotGPT service, which is enabled only if you explicitly request it.