Security
Reserve confidently.
Least privilege, revocable in one click, and you stay in control of every dollar that moves — whether you're covering ten reservations or ten thousand.
Least privilege, by design
Two roles. Neither can touch your workloads.
Watching your fleet and buying a reservation are different levels of trust, so they use different roles. You grant each independently, and either can be revoked without affecting the other.
Watch — read-only
{
"Version": "2012-10-17",
"Statement": [{
"Effect": "Allow",
"Action": [
"ec2:DescribeRegions",
"ec2:DescribeInstances",
"ec2:DescribeReservedInstances",
"rds:DescribeDBInstances",
"rds:DescribeReservedDBInstances",
"elasticache:DescribeCacheClusters",
"elasticache:DescribeReservedCacheNodes",
"elasticache:ListTagsForResource",
"cloudwatch:GetMetricData"
],
"Resource": "*"
}]
}The entire read-only policy. Can read the shape of the fleet; cannot start, stop, modify, or delete anything.
Autopilot — purchase only
{
"Version": "2012-10-17",
"Statement": [{
"Effect": "Allow",
"Action": [
"rds:PurchaseReservedDBInstancesOffering",
"elasticache:PurchaseReservedCacheNodesOffering",
"ec2:PurchaseReservedInstancesOffering"
],
"Resource": "*"
}]
}Representative, scoped to purchasing. Cannot touch your workloads, data, or networking — buying a reservation is the only thing this role can do.
How the connection is secured
You grant it. You can take it back.
CloudFormation 1-click role
You create the role from our template — a quick-create-stack URL, not a hand-typed policy. The role trusts only Reserver's scanner principal.
Confused-deputy protection
The trust policy requires an ExternalId derived from the stack's own GUID, so no other party can assume your role — even if they somehow learned the role ARN.
No agent in your VPC
Nothing is deployed into your network. Reserver talks to AWS APIs directly, from the outside, using the role you granted.
Revoke anytime
Delete the role in your AWS console and access ends immediately — no support ticket, no waiting on us.
One account or a whole Organization
Connect a single AWS account or an entire AWS Organization from one stack — the same read-only model scales either way.
You control every purchase
Nothing buys anything without your say.
- Approvals before money moves — any automated rule can require a sign-off step before a purchase executes.
- Full audit trail — every purchase, manual or automatic, is logged: who approved it, what it cost, why.
- Watch-only mode never buys — the basic plan reads your fleet and recommends; it never spends on its own.
- Automation is opt-in, per rule — renewal autopilot, scheduled purchases, and age-based rules only run if you turn each one on.
Isolation & data handling
Your data stays yours, and stays separate.
- Org-scoped everything — one organization's fleet, reservations, and members are never visible to another.
- Metadata, not your data — Reserver stores the fleet and reservation metadata needed to match them: instance classes, regions, engines, terms — never database contents, cache values, or application data.
- Assume-role only — cross-account access always goes through the role you granted; we never see or store AWS access keys.
- Certifications on the roadmap — Reserver is pre-launch; we'd rather say that plainly than claim a badge we don't have.
Built for every size
The same trust model, whatever your scale.
Questions
Trust questions, straight answers.
What can the read-only role actually do?
Nine named Describe/List calls, for RDS, ElastiCache, and EC2 — no service-wide wildcards. It can read the shape of your fleet — instance types, regions, tags, reservation details — and nothing else. It cannot start, stop, modify, or delete anything.
What can the purchase role actually do?
It's a separate role scoped to the AWS reservation purchase APIs — rds:PurchaseReservedDBInstancesOffering and equivalents for ElastiCache and EC2. It cannot touch your running workloads, your data, or your networking.
Can Reserver see our data, not just our infrastructure metadata?
No. Reserver reads infrastructure metadata used for matching — instance classes, regions, engines, reservation terms — never database contents, cache values, or application data.
Is our data isolated from other customers?
Yes. Every record is scoped to your organization; cross-organization access isn't a permissions check that can be misconfigured; it simply returns not-found.
How do you access our AWS accounts — do you store credentials?
Cross-account access is assume-role only, using the role you created and can revoke. We never see or store your AWS access keys.
Can something buy a reservation without our sign-off?
Only if you set it up that way. Watch-only mode never buys anything. On Autopilot, every rule can require an approval step before a purchase executes, and every purchase — manual or automatic — is logged with who, what, and when.
Are you SOC 2 or ISO 27001 certified?
Not yet — Reserver is pre-launch. Formal certifications are on the roadmap; we'd rather say that plainly than claim something we can't back up.
Want the full walkthrough of what Reserver connects to and why? See how it works.
Stop overpaying for a steady fleet.
Reserver is in early access. Join the list and we'll onboard you as capacity opens up — first recommendation within minutes of connecting.