About MarshalCloud
The company behind MarshalCloud.Read-only first
MarshalCloud is a product of DEVINSEC PVT. LTD, Kathmandu, Nepal, in early access. It watches cloud cost, security and uptime for teams with no ops staff, drafts a fix, and waits for a person to approve.
- Company
- A product of DEVINSEC PVT. LTD, Kathmandu, Nepal
- Started building
- February 2026
- Status
- Early access
- Your data lives
- On AWS, Asia Pacific (Mumbai) region
- Built deepest for
- AWS, with Google Cloud and Kubernetes on Growth and above
- Security contact
- hello@marshalcloud.com, "Security report" in the subject
Why does it exist?
Most small companies run their cloud with nobody whose job it is. MarshalCloud reads the bill, the security settings and the uptime as one problem, dollar impact first.
The MarshalCloud team started building it in February 2026. It runs on itself.
What MarshalCloud believes, and will not claim
Read-only first
Connecting asks for read access only: a role that can describe, list and get, or a read-only token. Fixes need a second, separate role or token you choose to add.
It will not need write access to show you anything.
A person approves every change
The AI analyst reads your data and proposes fixes. It never approves or runs one; each fix waits for a person.
It will not claim an undo it has not tested. Rollback is stated per action, before you approve.
Unknown is never green
A check that has not run, or ran on stale data, reads as unknown, not as a pass.
It will not show a passing security or uptime result over missing data, or call readiness evidence a SOC 2 certification.
Your bill, not a benchmark
A dollar figure comes from your own bill or a provider's price.
It will not show a savings figure it cannot source. Otherwise it is $0, marked low confidence.
Security posture, and where your data lives
Where your data lives
Everything MarshalCloud holds about your account is stored on AWS in the Mumbai region.
What it can read, and where it is keptHow it reaches your cloud
A cross-account read-only role with a unique External ID: no long-lived key to hold. Any token you paste is encrypted and never shown back.
What it can read, and never touchWhat we hold today
No SOC 2 or ISO 27001 report yet; formal SOC 2 work is in progress. A data processing addendum is published.
How we hold your dataIf you find a problem
Report a vulnerability to hello@marshalcloud.com, "Security report" in the subject. A person replies within one business day, with no action against good-faith reporters.
Report a security issue
Questions? Ask the team that builds it
Product, security or data handling: pick a topic and a person reads it. Early access is open: start free on one AWS account, or ask for a walkthrough first.