Security
Your cloud credentials stay in your environment
IaCConsole separates the control plane from execution. The web console orchestrates, while Terraform and OpenTofu run through a Secure Agent on your machine or CI runner.
Secure Agent Mode
The default way to run production infrastructure with IaCConsole. Execution happens where your credentials already live, and the platform never needs a copy of them.
Local execution
Your Terraform or OpenTofu runs on your machine or CI/CD runner. The platform does not need your AWS, Azure, or GCP secret keys.
Secure Agent relay
The web console acts as a control plane, sending instructions to your local agent through an encrypted relay.
Zero-storage keys
Keys stay in your environment variables or vault. Our database stores metadata and audit logs, not cloud credentials.
Two execution modes
Choose the model that fits your team. You can start managed and move to Secure Agent Mode later without rewriting your infrastructure.
Secure Agent Mode
Terraform/OpenTofu runs in your environment. Credentials stay in your environment variables or vault. Recommended for production and regulated workloads.
Platform-managed execution
Scoped cloud credentials are used to provision resources on your behalf. Useful when you want the agents to run without a local agent, and still exportable to standard HCL at any time.
What we store
We keep the minimum needed to run your account and show you what happened.
- Account details: name, email address, and GitHub profile ID when you sign in with GitHub.
- Usage data: input and output token counts used for metered billing.
- Project metadata: projects, units, dimensions, and deployment history.
- Assistant conversations and generated infrastructure code, so you can return to them.
- A Slack bot token if you connect Slack to your workspace.
- Technical logs needed to operate and secure the service.
AI processing
Managed Cloud uses Google Gemini 3 Flash through Vertex AI. Your prompts and infrastructure code are not used to train foundation models, and premium data is handled through private Vertex AI endpoints.
Open standards
Everything we generate is standard Terraform or OpenTofu HCL. Export it and run it anywhere. There is no proprietary runtime required for your infrastructure code.
Report a vulnerability
Found a security issue? Email dima@iacconsole.com with the subject line “Security”. We will acknowledge your report and keep you updated on the fix.
Frequently asked questions
The questions teams ask before running production infrastructure with us.
Do you store my AWS or GCP credentials?
In Secure Agent Mode, no. Terraform and OpenTofu run in your environment, and your cloud credentials stay in your environment variables or vault. The web console only relays execution instructions to your agent. If you choose platform-managed execution, scoped credentials are used for provisioning on your behalf.
Where does Terraform actually run?
In Secure Agent Mode, Terraform and OpenTofu run on your machine or CI/CD runner. Platform-managed execution is available for teams that prefer not to run an agent; you can switch to Secure Agent Mode at any time.
Is my code used to train AI models?
No. Managed Cloud uses Google Gemini 3 Flash through Vertex AI, and your infrastructure code and prompts are not used to train foundation models. Premium data is handled through private Vertex AI endpoints.
Can I self-host the whole platform?
Yes. The Design Partner program deploys the full platform on a single Google Cloud VM in your own account, including the API, app, MCP server, CLI, and CMDB. AI tokens are billed directly to your GCP account.
Review the architecture before you connect a cloud account
Start with the open-source CLI and Secure Agent Mode, or book a short call to walk through your setup.