How Tudovu handles AWS and GitHub access.
Tudovu asks for access to your AWS account and selected GitHub repositories. This page explains what that access is, how reviewed changes reach your account, and how the platform that uses it is run.
Tudovu's own policies and compliance documents are available on request through our Trust Center, hosted by Thoropass.
Tudovu proposes. Your pipeline deploys.
Tudovu proposes infrastructure changes in your repository. Nothing reaches your account until your team merges and your own pipeline deploys it; Tudovu then re-runs the check to confirm the fix landed.
Read and check
Tudovu reads your account through a role you create and runs its security checks against it.
Propose a reviewed change
Fixes arrive as CloudFormation in your repository, with the check they satisfy named in the review.
You merge, your pipeline deploys
The product does not merge code changes. Deploys run in your GitHub Actions under a role only that workflow can assume.
What you grant, and why.
| Access | What it is | Used for |
|---|---|---|
| AWS read role | A role created by a CloudFormation stack you launch. Tudovu assumes it with an external ID for one-hour sessions. It uses the AWS managed SecurityAudit and ReadOnlyAccess policies, plus a few narrow actions the checks need, such as generating the IAM credential report. | Running checks, reading findings from Security Hub, GuardDuty, and Inspector, inventory, and cost data. |
| AWS deploy role | A separate role that only your GitHub Actions workflow can assume through GitHub OIDC, pinned to your repository and branch. Roles it creates carry a permissions boundary that blocks attaching administrator access, creating access keys, and disabling CloudTrail, GuardDuty, AWS Config, or Security Hub. | Deploying the changes your team merged, through your own workflow. |
| GitHub App | Installed on the repositories you choose. It can write repository contents, pull requests, and workflow files, and read check and Actions status. | Opening and updating reviewed changes and adding the Tudovu deploy workflow. |
Tudovu doesn't use or store AWS access keys for your account. Access is by role assumption only, and you can remove it at any time by deleting the stacks and uninstalling the GitHub App.
Optional capabilities that act directly in your account, such as Reclaimer rehearsals and in-account remediation executors, are off by default and are enabled per organization.
How we run Tudovu.
Hosting and data
- Runs on AWS in us-east-1, in private subnets behind AWS WAF
- Multi-AZ PostgreSQL database, encrypted at rest, with automated backups
- Evidence files in an encrypted, versioned S3 bucket with public access blocked and short-lived download links
Accounts and secrets
- Platform secrets kept in AWS Secrets Manager
- Passwords hashed with bcrypt; session and API tokens stored only as hashes
- Sign in with email and password or Google, with optional authenticator-app MFA
Our own delivery
- Production releases must pass secret scanning, static analysis, container scanning, and dynamic scanning
- Our own infrastructure is defined in CloudFormation and deployed through CI/CD
- Tudovu's policies are documented in our Trust Center
How Tudovu uses AI models.
Tudovu's agents use Anthropic Claude models through Amazon Bedrock in AWS. To draft fixes, documents, and answers, they send the context the task needs: findings and check results, AWS inventory, repository files, code review and CI output, and documents you upload.
Agents draft; people decide. Code changes wait for your team to merge them, and generated policies and documents are created for review before they can be shared.
Report a vulnerability.
If you believe you have found a security issue in Tudovu or this website, email team@tudovu.com with the subject "Security report", a description, and the steps to reproduce it. Our contact details are also published in security.txt.
Please do not access or modify data that isn't yours, degrade the service, or disclose the issue publicly before we have had a reasonable chance to fix it. We will acknowledge your report and keep you updated.