Architecture overview
How Cushy works: one console with a distinct URL per screen, keyless read-only adapters for all four clouds, a background sync engine, encryption at rest, and strict per-organization isolation.
Cushy is a hosted, multi-tenant console — a single pane of glass over AWS, GCP, Azure and Alibaba Cloud. This page describes the properties that matter to you as a customer: how the console is organized, how it reaches your clouds, how your data stays fresh, and how it is protected.
The console
Every screen has a distinct, deep-linkable URL — /dashboard, /inventory, /network, /cost, /audit, and so on — each validating your session server-side on a direct load. After the first load, switching screens stays client-side, so the app feels instant. Links to any screen can be bookmarked and shared within your team.
Keyless cloud adapters
Cloud integrations are real for all four clouds and always keyless: AWS uses a cross-account IAM role assumed with STS, GCP uses workload identity federation with Cloud Asset Inventory, Azure uses an Entra federated credential (no client secret) with Azure Resource Graph/ARM, and Alibaba uses RAM AssumeRoleWithOIDC (no AccessKeySecret). Cushy never stores a long-lived cloud credential — you grant a trust you control and can revoke at any time, and discovery access is read-only.
The sync engine
Inventory freshness is the job of a single background engine driven three ways: a scheduled pass, a 'connect-kick' immediately after a connection turns healthy, and on-demand 'Sync now'. The engine respects each provider's rate limits with polite backoff and fetches deltas where it can. The browser never calls a cloud API directly — every screen reads shaped, already-synced data. See Resource inventory & sync.
Encryption at rest
Every secret your organization entrusts to Cushy — SSO client secrets, Git personal access tokens, Terraform state versions, support-ticket attachments, metrics-endpoint tokens — is sealed in an AES-256-GCM envelope before it is stored, and is never returned by any API. Responses only ever report whether a secret is set.
Organization isolation
Every request is scoped to your organization at the data-access layer, not in the UI. No endpoint returns another organization's data, and an identifier from another tenant answers the same 404 as one that does not exist. See Multi-tenancy & data isolation.
Request lifecycle
Edge middleware does a fast cookie-presence check only, redirecting page requests without a session to /login and answering API requests with a JSON 401. Real session validation happens server-side on every route, and your role's capabilities are recomputed per request — a role change takes effect on the very next request.