Security
Reserve confidently.
Least privilege, revocable in one click, and you stay in control of every dollar that moves, whether you're covering ten reservations or ten thousand.
Least privilege, by design
One role live. One role planned.
Watching your fleet uses a read-only role today, and connects in one click. Buying a reservation needs its own role, scoped tighter still, and that role has not shipped yet.
Watch: read-only
{
"Version": "2012-10-17",
"Statement": [{
"Effect": "Allow",
"Action": [
"ec2:DescribeRegions",
"ec2:DescribeInstances",
"ec2:DescribeReservedInstances",
"rds:DescribeDBInstances",
"rds:DescribeReservedDBInstances",
"elasticache:DescribeCacheClusters",
"elasticache:DescribeReservedCacheNodes",
"elasticache:ListTagsForResource",
"cloudwatch:GetMetricData"
],
"Resource": "*"
}]
}The entire read-only policy. Can read the shape of the fleet; cannot start, stop, modify, or delete anything.
Autopilot: purchase only building · M4
{
"Version": "2012-10-17",
"Statement": [{
"Effect": "Allow",
"Action": [
"rds:PurchaseReservedDBInstancesOffering",
"elasticache:PurchaseReservedCacheNodesOffering",
"ec2:PurchaseReservedInstancesOffering"
],
"Resource": "*"
}]
}No purchase role exists yet. Representative of what it will request: scoped to purchasing, unable to touch your workloads, data, or networking. Buying a reservation will be the only thing this role can do.
How the connection is secured
You grant it. You can take it back.
CloudFormation 1-click role
You create the role from our template: a quick-create-stack URL, not a hand-typed policy. The role trusts only Reserver's scanner principal.
Confused-deputy protection
The trust policy requires an ExternalId derived from the stack's own GUID, so no other party can assume your role, even if they somehow learned the role ARN.
No agent in your VPC
Nothing is deployed into your network. Reserver talks to AWS APIs directly, from the outside, using the role you granted.
Revoke anytime
Delete the role in your AWS console and access ends immediately. No support ticket, no waiting on us.
One stack, one accountnext · M6
each stack connects one AWS account. One-stack AWS Organizations discovery will connect every member account at once, with the same read-only model.
Nothing buys without your say
Nothing can buy a reservation today, on any plan.
- Nothing buys today, on any plan: the basic plan reads your fleet and recommends; no plan spends on its own, because no purchase code exists yet.
- Approvals will gate every purchase: once the purchase role ships, any automated rule will be able to require a sign-off step before a purchase runs.building · M4
- A full audit trail is planned: every purchase, manual or automatic, will be logged: who approved it, what it cost, why.building · M4
- Automation will stay opt-in, per rule: renewal autopilot, scheduled purchases, and age-based rules will each need to be turned on before they run.building · M5
Isolation & data handling
Your data stays yours, and stays separate.
- Org-scoped everything: one organization's fleet, reservations, and members are never visible to another.
- Metadata, not your data: Reserver stores the fleet and reservation metadata needed to match them: instance classes, regions, engines, terms. Never database contents, cache values, or application data.
- Assume-role only: cross-account access always goes through the role you granted; we never see or store AWS access keys.
- Certifications on the roadmap: Reserver is pre-launch; we'd rather say that plainly than claim a badge we don't have.
Built for every size
The same trust model, whatever your scale.
Questions
Trust questions, straight answers.
What can the read-only role actually do?
Nine named Describe/List calls, for RDS, ElastiCache, and EC2. No service-wide wildcards. It can read the shape of your fleet: instance types, regions, tags, reservation details, and nothing else. It cannot start, stop, modify, or delete anything.
What will the purchase role be able to do?
The purchase role is not built yet. Reserver cannot buy anything today, on any plan. Once it ships, it will be a separate role scoped to the AWS reservation purchase APIs: rds:PurchaseReservedDBInstancesOffering and equivalents for ElastiCache and EC2. It will not be able to touch your running workloads, your data, or your networking.
Can Reserver see our data, not just our infrastructure metadata?
No. Reserver reads infrastructure metadata used for matching: instance classes, regions, engines, reservation terms. Never database contents, cache values, or application data.
Is our data isolated from other customers?
Yes. Every record is scoped to your organization. Access from another organization returns not-found. No permissions check exists there that someone could misconfigure.
How do you access our AWS accounts? Do you store credentials?
Cross-account access is assume-role only, using the role you created and can revoke. We never see or store your AWS access keys.
Can something buy a reservation without our sign-off?
Nothing can buy anything today, on any plan. No purchase role exists yet, so there is no automatic buying to configure. Once Autopilot ships, each rule will be able to require an approval step before a purchase runs. Every purchase will be logged with who, what, and when.
Are you SOC 2 or ISO 27001 certified?
Not yet. Reserver is pre-launch. Formal certifications are on the roadmap; we'd rather say that plainly than claim something we can't back up.
Want the full walkthrough of what Reserver connects to and why? See how it worksfor the account side, or privacy for the data side. Every question the site answers is on one page →. Running a formal security review? Start with thesecurity review pack.
Stop overpaying for a steady fleet.
Reserver is in early access. Join the list, and we will onboard you when we have capacity. Your first recommendation lands within minutes of connecting.