The questions your team will raise.

A read-only IAM role you create in your own account: list/describe/get permissions only, protected by a unique external ID against confused-deputy attacks, and explicitly barred from reading secret values. No agents, no inbound network access, revocable by you at any time. Every discovery session is visible in your own CloudTrail.

Under an hour for a first account, once your administrator can approve the read-only role. Launch a CloudFormation stack or apply a Terraform module, and discovery starts building your inventory immediately: 84 resource types across 30 AWS services. A guided checklist covers environments, ownership rules, alerts, and your first report.

You choose the region at signup (United States, Germany, or Singapore at launch), and your inventory and evidence are hosted there, with encrypted disaster-recovery backups held in the other regions named in our Terms and DPA. Audit evidence is kept in write-protected, tamper-evident storage for 1 year on every plan, extendable on paid plans to 3, 5 or 7 years with the data-retention add-on, while you are a customer, and can be exported for auditors (SOX, ISO 27001, SOC 2). It can't be changed in normal operation. Personal data can still be erased on request.

That's the design goal: SAML/OIDC SSO, SCIM provisioning, enforced MFA, role-based access with five permission levels, IP allow-listing, DNS-verified email domains, tenant-scoped data isolation, encryption at rest and in transit, and an in-app audit trail with export (SIEM streaming in JSON or CEF is rolling out on Enterprise). Ask us for the security architecture pack.

Yes. SAML 2.0 and OIDC single sign-on and enforced MFA are on every plan; SCIM provisioning is Enterprise. Bring your own identity provider, such as Okta or Entra ID, and route users by email domain.

Omnitam's is maintained by discovery. It reconciles continuously against your real cloud, so it never goes stale. It feeds your ITSM workflows through the API and webhooks rather than replacing them. It's also cloud-native SaaS: no mid-six-figure implementation project, no consultants.

AWS today: 84 resource types across 30 services, connected by 47 relationship types. Discovery runs hourly on Essential and near real-time on Standard and above. Additional clouds are on the roadmap; SBOM ingestion (SPDX / CycloneDX) already covers software running anywhere.