Support and SLA
Who we are, how we support you, and what we commit to.
Company overview, service description, support model and SLA commitments, with the incident and vulnerability processes behind them.
| Legal entity | Aurea, Inc. (a subsidiary of ESW Operations, LLC) |
|---|---|
| Product | CloudFix: automated AWS cost optimisation platform |
| Headquarters | United States |
| Platform hosting | Amazon Web Services, us-east-1 (N. Virginia) |
| AWS partner status | ISV Accelerate Partner · Cloud Operations Competency (Cost Management) |
| Certifications and memberships | SOC 2 Type 2 audited · FinOps Foundation Member |
Service description
A SaaS platform that finds and fixes AWS waste.
CloudFix works through a read-oriented IAM role model deployed into your account by CloudFormation StackSet: no agents, no third-party software, only AWS-native services.
Finders
110+ automated finders scan your AWS account metadata (Cost and Usage Reports, CloudWatch metrics, resource configuration) for savings across 30+ AWS services.
Fixers
For each opportunity you choose to act on, the fix runs as an AWS Systems Manager Automation runbook in your account, only after your explicit approval, and every execution is logged. Never automatically.
RightSpend
An optional module for Reserved Instance and Savings Plan management: automated purchase recommendations and RI conversion optimisation.
API and integrations
A REST API and outbound webhooks connect CloudFix to ITSM and service desk platforms, so recommendations flow through your existing approval workflow.
What CloudFix accesses in your AWS account
- AWS Cost and Usage Reports: billing and usage metadata only
- CloudWatch metrics: performance and utilisation data for optimisation analysis
- CloudTrail logs: read access for audit and recommendation context
- Resource metadata through Describe, List and Get calls; no access to application data, S3 object contents or database records
CloudFix deploys no agents or third-party code into your account. All activity there uses AWS-native services only: CUR, CloudWatch, S3, Athena, Glue, Lambda, SSM and CloudFormation.
Support model
Three ways to reach us.
Support runs 09:00 to 18:00 ET, Monday to Friday. Critical (P1) incidents are monitored outside business hours with on-call escalation.
Support portal
The primary channel for support requests, product questions and incident reports. Powered by Kayako.
support.cloudfix.comTrust Center contact form
Security concerns, compliance queries, documentation requests and vulnerability reports.
trust.cloudfix.com/contactIn-app support
Contextual help and ticket submission from inside the CloudFix dashboard, when you are signed in.
Sign in to CloudFix
Service level commitments
Availability and response times.
Platform availability
- CloudFix dashboard: 99.5% uptime target, per calendar quarter, excluding maintenance windows
- API: 99.5% uptime target, per calendar quarter
- Scheduled maintenance: announced at least 72 hours ahead, typically 02:00 to 04:00 UTC
- Exclusions: AWS infrastructure incidents, force majeure, customer-caused outages
Business hours
09:00 to 18:00 ET, Monday to Friday, excluding US public holidays. P1 incidents are monitored on call outside business hours. Live status is on the status page.
Incident response SLA
| Priority | Definition | Initial response | Resolution target |
|---|---|---|---|
| P1: Critical | Platform completely unavailable or data integrity at risk; no workaround | 1 hour | 4 hours |
| P2: High | Significant feature impairment; partial workaround available | 4 business hours | 2 business days |
| P3: Medium | Non-critical issue; workaround available | 1 business day | 5 business days |
| P4: Low | General questions, feature requests, documentation queries | 2 business days | Best efforts |
Escalation path
| Level | Contact | Trigger |
|---|---|---|
| Level 1 | CloudFix support team, through support.cloudfix.com | All initial requests |
| Level 2 | Senior support engineer (automatic for P1 and P2 after the initial response SLA) | P1 unresolved after 2 hours · P2 unresolved after 1 business day |
| Level 3 | Engineering team lead | P1 unresolved after 4 hours · complex issues needing engineering |
| Security escalation | Security team, through the Trust Center contact form | Any security incident or vulnerability report |
Incident management
A structured process, aligned with SOC 2.
Detection and classification
Incidents are detected by automated monitoring, customer reports or internal escalation. An incident commander is assigned and the incident is classified P1 to P4 by impact and scope.
Customer notification
P1 and P2: status page updated within 30 minutes of confirmation, and affected customers notified in app or by email. Security incidents: within 24 hours, whatever the severity. Data breaches: within 72 hours, as regulations require.
Resolution and review
After a P1 or P2, a post-incident review within 5 business days documents root cause, contributing factors, timeline and corrective actions. Summaries are available on request.
Change management
Production changes to the CloudFix platform go through peer review, staging tests and phased rollout. Emergency changes get a post-implementation review. Maintenance is announced 72 hours ahead.
Vulnerability management
Internal programme and responsible disclosure.
- Regular third-party penetration testing; results under NDA (request through the compliance page)
- Continuous automated dependency scanning for known CVEs
- Internal security assessments aligned with SOC 2
- Patch policy: critical CVEs remediated within 30 days of disclosure, high within 60 days
Report a vulnerability
- Submit details through the contact form, choosing Vulnerability report as the subject.
- Include a clear description, steps to reproduce and the potential impact.
- We acknowledge within 24 hours and give an initial assessment within 72 hours.
- We ask for a 90-day disclosure window from the first report, so we can remediate before public disclosure.
- Coordinated disclosure is welcome: we keep you informed and tell you when the fix is deployed.
CloudFix does not run a formal bug bounty programme. The security team handles every responsible disclosure report directly.
Questions about our support model?
Talk to the CloudFix team about enterprise SLA terms or specific support requirements.