Name: Cloudairy
Brand: Cloudairy
Availability: InStock
Rating: 4.9 (670 reviews)

Question 1

What is Cloudairy?

Accepted Answer

Cloudairy is a software company focused on building intelligent, collaborative platforms that simplify complex workflows through visual design, Al automation, and team-based ideation tools. The platform empowers users across industries to visualize systems, map business processes, and drive strategic collaboration -whether for cloud architecture, brainstorming sessions, or agile planning. Delivered as a Saas platform, Cloudairy's services are accessible via secure web applications with multi-tenant architecture hosted on enterprise-grade cloud infrastructure.

Question 2

Where is Cloudairy headquartered?

Accepted Answer

Cloudairy LLC is headquartered at 22960 Carters Station Ct, Ashburn, VA 20148, United States.

Question 3

What compliance certifications does Cloudairy hold?

Accepted Answer

Cloudairy holds four compliance certifications: (1) SOC 2 Type II — attestation covering all five Trust Services Categories (Security, Availability, Processing Integrity, Confidentiality, Privacy), issued January 2026 by Precision Assurance CPA LLC with a clean (unqualified) opinion. (2) ISO/IEC 27001:2022 — Information Security Management System certification issued November 2025 by QRO, valid through November 2028. (3) GDPR Certification — certified under the GDPR Management Standard by UKCert, issued March 2026, valid through March 2029. (4) GDPR Compliance Audit — independent audit by Veroscert/UKcert confirming full compliance across all 8 assessment areas.

Question 4

What does the SOC 2 Type II report cover?

Accepted Answer

Cloudairy's SOC 2 Type II report covers all five Trust Services Categories defined by the AICPA: Security, Availability, Processing Integrity, Confidentiality, and Privacy. The report was prepared in accordance with AT-C Section 205 and TSP Section 100 standards. The examination period was August 31, 2025 through November 30, 2025, and the independent auditor (Precision Assurance CPA LLC) issued an unqualified (clean) opinion, confirming that controls were suitably designed and operating effectively throughout the review period. Cloudairy uses the SOCLY platform for continuous compliance monitoring.

Question 5

What is the scope of the ISO 27001 certification?

Accepted Answer

Cloudairy's ISO/IEC 27001:2022 certification (Certificate #305025111417IS) covers the Information Security Management System for the Cloudairy platform. It was issued by QRO on November 14, 2025, is valid through November 13, 2028, and references the Statement of Applicability version 1.0 dated June 20, 2025.

Question 6

What areas were assessed in the GDPR compliance audit?

Accepted Answer

The independent GDPR compliance audit (conducted by Veroscert/UKcert on February 23, 2026) assessed eight areas, all of which received a "Complied" rating: (1) Accountability & Governance — DPO designated, policies documented, regular staff training. (2) Lawful Processing — legal basis documented for all processing activities. (3) Privacy by Design — DPIAs conducted, privacy embedded in product lifecycle. (4) Data Subject Rights — mechanisms for access, rectification, erasure, portability. (5) Consent Management — granular consent mechanisms with clear withdrawal. (6) Breach Management — 72-hour notification to supervisory authorities. (7) Third-Party Processors — DPAs in place, regular assessments. (8) Cross-Border Transfers — Standard Contractual Clauses (SCCs) implemented.

Question 7

Can I request a copy of the SOC 2 report or other compliance documents?

Accepted Answer

Yes. SOC 2 Type II reports, ISO 27001 certificates, GDPR certificates, penetration test summaries, and other compliance documentation are available upon request. Click "Request Docs" in the header or visit the Documents tab to submit a request. Our security team typically responds within 1 business day.

Question 8

Where is my data stored?

Accepted Answer

By default, customer data is stored in AWS US-EAST-1 (N. Virginia, United States). An EU region instance is available for organizations requiring European data residency. All data is encrypted at rest using AES-256 and in transit using TLS 1.2+. Backup data is encrypted and stored in geographically separate locations.

Question 9

How does Cloudairy protect personal data under GDPR?

Accepted Answer

Cloudairy implements a comprehensive GDPR compliance framework including: a designated Data Protection Officer (DPO) with reporting authority to the highest level of management; documented data protection policies and records of processing activities; Privacy by Design architecture with Data Protection Impact Assessments (DPIAs) for high-risk processing; GDPR awareness training for all employees handling personal data; mechanisms for data subject rights (access, rectification, erasure, portability, restriction, objection); 72-hour breach notification to supervisory authorities; Standard Contractual Clauses (SCCs) for international data transfers; and Data Processing Agreements (DPAs) with all subprocessors.

Question 10

Does Cloudairy have a Data Protection Officer (DPO)?

Accepted Answer

Yes. Cloudairy has designated a Data Protection Officer (DPO) who has reporting authority to the highest level of management, necessary resources, independence, and authority to fulfill their role. The DPO oversees data protection compliance, advises on DPIAs, and serves as the point of contact for data subjects and supervisory authorities.

Question 11

How does Cloudairy handle cross-border data transfers?

Accepted Answer

Cloudairy uses Standard Contractual Clauses (SCCs) approved by the European Commission to ensure lawful transfer of personal data across borders. Management performs periodic reviews to ensure ongoing compliance with data residency transfer requirements across systems and data flows. An EU region instance is also available for organizations that require data to remain within the European Union.

Question 12

What data subject rights does Cloudairy support?

Accepted Answer

Cloudairy supports all GDPR data subject rights including: Right to Access (obtain copies of personal data), Right to Rectification (correct inaccurate data), Right to Erasure (request deletion), Right to Data Portability (receive data in machine-readable format), Right to Restrict Processing, and Right to Object to specific processing activities. Procedures and mechanisms are in place to process these requests in a timely manner.

Question 13

What is Cloudairy's data retention policy?

Accepted Answer

Cloudairy maintains defined data retention and deletion policies. Data is retained only for as long as necessary to fulfill the purposes for which it was collected, or as required by applicable laws and regulations. Customers can request data deletion in accordance with data subject rights and contractual terms.

Question 14

What cloud infrastructure does Cloudairy use?

Accepted Answer

Cloudairy is hosted entirely on Amazon Web Services (AWS), which is SOC 2, ISO 27001, and FedRAMP certified. Key infrastructure components include: Amazon EC2 for scalable compute, AWS Amplify for frontend hosting with CDN, Elastic Load Balancer for traffic distribution and failover, Amazon VPC for network isolation with private subnets, AWS WAF for web application firewall protection, Aurora PostgreSQL Serverless for encrypted database services, and Amazon S3 for encrypted object storage with versioning.

Question 15

How is data encrypted?

Accepted Answer

All data at rest is encrypted using AES-256 encryption, including database records, object storage, and backups. All data in transit is encrypted using TLS 1.2 or higher, including client-to-server and internal service-to-service communication within the VPC. Key management is handled via AWS KMS.

Question 16

Does Cloudairy conduct penetration testing?

Accepted Answer

Yes. Cloudairy conducts regular penetration testing through qualified third-party security firms. Findings are prioritized based on severity and tracked through remediation. Automated vulnerability scanning also runs continuously across infrastructure and application code. A summary of penetration test results is available upon request through the Documents section.

Question 17

How does Cloudairy handle security incidents?

Accepted Answer

Cloudairy has a documented incident response plan with four phases: (1) Identification & Triage — automated monitoring detects potential incidents, security team classifies severity. (2) Containment — immediate isolation of affected systems and evidence preservation. (3) Eradication & Recovery — root cause removal, patching, and system restoration from clean backups. (4) Post-Incident Review — post-mortem analysis, lessons learned, and procedure updates. Data breaches involving personal data are reported to supervisory authorities within 72 hours as required by GDPR. Customers are notified within contractually agreed timeframes.

Question 18

Does Cloudairy support SSO and MFA?

Accepted Answer

Yes. Cloudairy supports Single Sign-On (SSO) via SAML 2.0 and OIDC for enterprise customers, enabling centralized identity management. Multi-Factor Authentication (MFA) is available for all customer accounts and is required for all Cloudairy employee access to production systems and administrative consoles.

Question 19

How does Cloudairy manage access to production systems?

Accepted Answer

Cloudairy enforces the Principle of Least Privilege through Role-Based Access Control (RBAC). Access to production environments is restricted to authorized personnel with documented approval processes. All access rights are reviewed quarterly, dormant accounts are automatically flagged and deprovisioned, and privileged access requires additional approval workflows, is time-limited, and fully audited. All authentication and authorization events are logged.

Question 20

Does Cloudairy use my data to train AI models?

Accepted Answer

No. Cloudairy does not use customer data to train or improve AI models. AI features process data within strict tenant boundaries with no cross-tenant data exposure. All AI-powered features are opt-in, and customers maintain full control over which AI capabilities are enabled for their organization.

Question 21

Who are Cloudairy's subprocessors?

Accepted Answer

As of March 2026, Cloudairy uses three subprocessors: (1) Amazon Web Services (AWS) — cloud infrastructure, global (US primary, EU available). (2) Stripe — payment processing, United States. (3) Amplitude — product analytics, United States (anonymized data). All subprocessors are bound by Data Processing Agreements (DPAs) and undergo regular security assessments. Customers are notified of any changes to the subprocessor list.

Question 22

What is Cloudairy's uptime SLA?

Accepted Answer

Cloudairy offers a 99.9% uptime SLA. The platform is monitored 24/7 with automated alerting for any service degradation. Infrastructure monitoring covers all AWS components including EC2, load balancers, database performance, and network traffic.

Question 23

How does Cloudairy ensure business continuity?

Accepted Answer

Cloudairy maintains documented business continuity and disaster recovery plans with defined RPO and RTO objectives. Automated daily backups with point-in-time recovery are stored in geographically separate locations. Plans are tested annually, and results are reviewed to update procedures based on test outcomes and evolving threats.

Cloudairy Trust Center