Security
Security is foundational to Azure Spend Watch. This page describes the technical and organizational measures we apply to protect your data and the Services.
1. Our Core Security Commitments
No Azure Credentials
We never request, store, or process your Azure credentials, service principals, or access tokens.
Webhook-Only Architecture
Azure pushes budget alerts to us. We never pull data from your Azure environment.
Encryption at Rest & In Transit
All data is encrypted in transit (TLS 1.2+) and at rest (Azure SQL Transparent Data Encryption).
Azure-Hosted Infrastructure
The Services run entirely on Microsoft Azure within the West Europe region.
2. Authentication and Access Control
2.1 User Authentication
Authentication is delegated entirely to Microsoft Entra External ID (CIAM). We support:
- Microsoft account sign-in,
- Google account sign-in,
- email and password (managed by Entra External ID).
We never store or handle passwords. Credential management is handled exclusively by Microsoft's identity platform.
2.2 Session Security
- Sessions are protected with HttpOnly, Secure, and SameSite=Lax cookies.
- Session tokens expire after 30 days of inactivity.
- HTTPS is enforced on all pages via HSTS.
2.3 Role-Based Access
All authenticated pages are protected by ASP.NET Core authorization policies. Unauthenticated requests are redirected to the login page.
3. Data Security
3.1 Encryption
- In transit: TLS 1.2 or higher is enforced for all connections. TLS 1.0 and 1.1 are disabled.
- At rest: Azure SQL Database Transparent Data Encryption (TDE) is enabled by default.
- Sensitive values: Webhook URLs and notification settings are stored in encrypted form using AES-256.
3.2 Secrets Management
Application secrets (database connection strings, API keys, signing keys) are stored in Azure Key Vault and accessed via Managed Identity — never hardcoded or stored in configuration files.
3.3 Database Security
- Azure SQL firewall rules restrict access to application subnets only.
- Connections use encrypted SQL connections with a minimum TLS version of 1.2.
- Database accounts follow the principle of least privilege.
4. Webhook Security
Azure Budget Alert webhooks are received and processed with the following controls:
- Webhook endpoints validate the incoming payload structure before processing.
- Paddle billing webhooks are verified using HMAC-SHA256 signature validation.
- Webhook endpoints are rate-limited and protected against replay attacks.
5. Infrastructure Security
- Hosting: Microsoft Azure (App Service, Azure SQL, Key Vault) — West Europe region.
- OS patching: Managed by Azure App Service platform — automatically kept up to date.
- DDoS protection: Azure-native DDoS protection is enabled at the platform level.
- Logging: Application and access logs are retained for security review and incident response.
6. Third-Party Integrations
| Service | Purpose | Data Shared |
|---|---|---|
| Microsoft Entra External ID | Authentication | Email, name, subject ID |
| WhatsApp Business API | Notification delivery | Phone number, alert message text |
| Paddle | Payment processing | Email, plan selection |
| Microsoft Azure | Hosting & storage | All application data (within Azure) |
All third-party providers are contractually bound to handle data in compliance with applicable privacy regulations.
7. Incident Response
In the event of a confirmed security breach affecting personal data, we will:
- notify affected users within 72 hours of becoming aware of the breach,
- report to the relevant supervisory authority as required by applicable law,
- take immediate steps to contain, investigate, and remediate the incident.
🔍 Responsible Disclosure
If you discover a security vulnerability in Azure Spend Watch, please report it responsibly. Do not publicly disclose the issue until it has been resolved.
Contact us at: [email protected]
We aim to acknowledge reports within 48 hours and resolve confirmed issues within 30 days. We appreciate the security community's efforts to keep our users safe.
8. Contact
Wertheimer Engineering Ltd
21 Sirkin st, Haifa, Israel
[email protected]