Security & Trust
We Only Read.
We Encrypt Everything.
Lizrd connects to your cloud and code read-only, seals every credential with strong encryption, and never changes your infrastructure without your explicit approval.
How We Keep You Safe
Read-Only by Design
You approve a least-privilege role. Lizrd reads, never writes — no modify, no delete.
Encrypted End to End
Every credential is sealed with AES-256-GCM envelope encryption and rotation-ready keys.
Isolated per Organization
Strict per-tenant isolation at the database layer — your data never crosses tenants.
Nothing Without Approval
Every change is proposed, and applied by you — never auto-run.
We Read Less Than You Think
Config, usage, and cost metadata — never your application or customer data.
Revoke in One Move
Remove the role or token and Lizrd loses all access immediately — no lingering credentials.
The exact scope
What Lizrd Accesses — and What It Doesn't
✓ Reads (read-only)
- ◆ Cloud resource inventory & configuration
- ◆ Utilization metrics & real, billed cost
- ◆ Repository & infrastructure-as-code metadata
✕ Never touches
- ◇ Your application data or customer data
- ◇ Source secrets or environment variables
- ◇ Any write, delete, or modify action
Revoke anytime — remove the role or token and Lizrd loses all access immediately.
More security questions? See the FAQ → Found a vulnerability? Email hello@lizrd.ai.
See It Safely
Connect read-only in minutes and watch the optimizations surface — nothing changes until you say so.