Security
NudgeBee is designed with security at its core. NudgeBee Cloud (the managed SaaS offering) is SOC 2 Type II certified and ISO 27001 certified. These certifications cover the hosted service; self-hosted (Community and Enterprise) deployments run entirely within your own infrastructure, under your own controls.
This page covers NudgeBee's Enterprise Guardrails — authentication, authorization, approval workflows, and audit trails — that keep your operations secure and compliant.
NudgeBee does not store passwords. All authentication is handled through SSO providers or magic email links, keeping your login process secure and simple.
Authentication
- OAuth SSO with Google, Okta, OneLogin, Azure AD (and B2C), and Auth0 is available in all editions (Community, Enterprise, Cloud). See Authentication Integration for setup.
- SAML 2.0 SSO (with IdP-driven user provisioning and group-to-role mapping) is available in the Enterprise and Cloud editions.
- Users without SSO can use magic email links — enter your email and receive a one-time login link. No password required.
- Credentials for external integrations are stored encrypted (AES-GCM) at rest using the
NUDGEBEE_ENCRYPTION_KEYset at install time.
Authorization
- Currently, NudgeBee supports tenant level authorization with 2 roles(admin, readonly)
Kubernetes Agent RBAC & Least-Privilege Permissions
For security compliance teams reviewing the in-cluster agent deployment, the NudgeBee agent requests read-only Kubernetes ClusterRole permissions by default:
| API Group | Resources | Verb Permissions | Purpose |
|---|---|---|---|
"" (Core) | pods, nodes, namespaces, services, endpoints, events, persistentvolumes, persistentvolumeclaims | get, list, watch | Topology mapping, resource health, and incident triage. |
apps | deployments, statefulsets, daemonsets, replicasets | get, list, watch | Workload configuration and right-sizing analysis. |
batch | jobs, cronjobs | get, list, watch | Batch workload failure detection. |
networking.k8s.io | ingresses, networkpolicies | get, list, watch | Traffic routing and network topology mapping. |
autoscaling | horizontalpodautoscalers | get, list, watch | HPA scaling tracking. |
The agent never reads Secret data contents (get or list on secrets is excluded from default ClusterRole bindings).
Network Security & Firewall Rules
| Traffic Flow | Direction | Protocol / Port | Destination | Purpose |
|---|---|---|---|---|
| Agent to Server | Outbound | TCP 443 (WSS / HTTPS) | app.nudgebee.com or self-hosted Ingress | Streaming metrics, events, and telemetry. |
| Server to Cloud Pricing | Outbound | TCP 443 (HTTPS) | AWS, GCP, Azure pricing endpoints | Cost calculations. Runs on the server; agents never call these. |
| Server to In-Cluster Relay | Inbound / Internal | TCP 8080 (Internal ClusterIP) | relay-server.nudgebee.svc | Real-time agent relay communication. |
Audit
- User operations are tracked and can be viewed on the UI.