If something ever went wrong
Simplio can only do in your AWS account what you have ticked for it, and nothing else: no creating, no deleting, no touching other services unless you included them. With the recommended connection (by role), that permission can also only be used from Simplio's servers: copying it is useless anywhere else. And you withdraw the access yourself from your AWS account in a minute, without asking us for anything.
No keys of yours to store
With the recommended connection, Simplio stores no key for your cloud: AWS gives it a pass that expires in one hour, and to withdraw access you delete that permission in your account. If you prefer a classic access key, it is stored encrypted with a master key that lives outside the database and is never shown again.
Minimum permissions per service and region
Each connection is limited to what it needs: one service, one region, a list of actions. Whatever happens, it can never touch more than that part. And you withdraw it in your cloud at any time. The optional blocks (terminal, costs, create) only exist if you include them.
Two-factor
A six-digit code from your phone to sign in, to stop or restart, to delete files, snapshots or copies, to upload code to a function, to remove a DNS record, to open a terminal and to use the spare key. No exceptions for administrators. A stolen password isn't enough to touch anything. So that it doesn't become a chore, after a correct code it is not asked for again for ten minutes, and from the third one in the same session, for two hours; deleting objects still requires typing their name. How two-factor works.
Permissions per person and per object
Each user sees and touches only what they have been granted: these machines, this bucket, this account, these actions. What is not granted does not appear. Permissions are enforced on the server on every query, not just on screen. How permissions work.
Full audit trail
Every action is logged with who, what, when and from which IP, including terminal openings, permission changes, spare key uses and two-factor activations or deactivations. Failed attempts too. Passwords that Simplio generates are never written to the log. How the log works.
IP blocking and attempt throttling
Repeated password attempts are slowed down and, if an address persists, it is blocked without being given any clue: not "wrong password", not "user does not exist", not "blocked". Bots that try passwords have nothing to work with. How the blocking works.
Recovering access without opening doors
If you forget your password, a one-time code arrives in your email and, if you have two-factor, the code from your phone is also needed: email never replaces it. If you lose your phone, you use one of the recovery codes you saved when you enabled it; if you don't have those either, the deactivation is not immediate: a two-day period opens in which you and your company's administrators receive a notice and can cancel it with one click. Every change closes all sessions, an email notice is sent and the notice carries a link to lock the account instantly if it wasn't you. The screen responds the same whether or not the email exists: nobody can find out who has an account. An account that nobody confirms is deleted on its own after a week, and the email is freed for its owner.
A spare key that only opens with your two-factor
The emergency door that Simplio leaves on your machines has no password to steal: it only accepts five-minute certificates signed by Simplio, only from Simplio's IP, and every use requires the code from your phone and is logged. The signing authority lives outside the database. The new password it generates is shown once and not stored. And you remove it from any machine whenever you like. How the spare key works.
Terminal without handing out keys
Your machines' console opens with the temporary credential that AWS hands over for each session, which never leaves the Simplio server: the browser receives a 60-second, single-use ticket. The SSH server's fingerprint is checked on every connection. Nobody receives a key file and nothing is installed on the machine. How the terminal works.
Encrypted secrets and credentials that renew themselves
The classic access keys you decide to store are encrypted with a master key that lives in a file outside the database, with read permissions only for the application, and are not shown again. The credentials the platform itself uses to talk to AWS are rotated automatically every 30 days, and can be rotated on the spot at any suspicion.
Each customer sees only their own
Simplio works like any cloud service you use daily: a shared platform where every piece of data carries its customer's identifier and every query filters by it, so each company only sees and touches its own. Designed for agencies that run the cloud of several customers, each one kept separate. If your policy requires a separate installation, tell us and we will consider it on the Empresa plan.
Nothing installed on your servers
Simplio works with the AWS APIs and, for the terminal and the spare key, with the SSH server the machine already has. There are no agents, no Simplio programs inside your machines, nothing to update or that could fail in there.
Do your customer or your adviser need more detail? Write to us and we'll go over it with them.