Firefly typical implementation process:
Initial Assessment and Planning: Evaluate the organization's current cloud infrastructure, objectives, and integration requirements to design the deployment approach for Firefly.
Account and Platform Setup: Configure organizational accounts and connect Firefly to existing cloud providers and Infrastructure-as-Code (IaC) frameworks (such as Terraform or AWS CloudFormation).
Asset Discovery: Firefly scans and inventories all cloud resources, dependencies, and ownership details across the enterprise for a baseline view.
Policy and Workflow Customization: Set up automated provisioning workflows, cost controls, compliance policies, and security guardrails according to the team’s operational needs.
AI-Agent and Automation Enablement: Activate Firefly’s AI-powered agents for drift detection, remediation, and real-time infrastructure insights within developer tools.
Training and Onboarding: Train platform engineers, DevOps, SecOps, and FinOps teams on using Firefly’s dashboards, analytics, and self-service features for effective adoption.
Firefly can be customized to fit specific business needs across various operational domains:
Organizations can define and automate self-service provisioning workflows to match custom development, security, or compliance requirements.
Teams can implement custom cost controls, tagging conventions, and budget policies tailored to their own FinOps strategies.
Firefly allows automatic conversion of unmanaged resources to user-preferred IaC frameworks (e.g., Terraform, AWS CloudFormation), enabling 100% coverage and alignment with any organization’s IaC standards.
Custom drift detection and remediation settings let businesses specify what constitutes out-of-baseline changes and how to respond.
Businesses can codify their own security measures and transform requirements into reusable, versioned Policy-as-Code models.
Over 600 compliance checks can be selectively integrated into CI/CD workflows to meet business-specific regulatory guidelines.
The platform supports mapping and custom tracing of assets, dependencies, and ownership, enabling tailored reporting and governance models for different organizational structures.
Change tracking can be configured for distinct workflows—from pull request visibility to production deployment monitoring—allowing businesses to align operational oversight with specific risk profiles.
Disaster recovery policies, including RTO (Recovery Time Objective) and BCDR (Business Continuity and Disaster Recovery) setups, are configurable to meet individual business continuity priorities.
Automations and alerts can be customized so that engineers and teams focus on company-specific tasks and not generic cloud configuration work.
Developers can use Firefly’s MCP Server with copilots like Claude or Cursor and adjust AI agent actions (codify resources, detect drift, trigger fixes) for unique operational footprints.
Firefly’s adaptive learning enables tailored reporting and insights based on an organization’s multi-cloud characteristics and needs.
Firefly offers a structured onboarding process for new users, guided by an onboarding wizard, along with support resources, documentation, and customer support channels to ensure a smooth start and ongoing assistance.
New users begin with an Onboarding Wizard that guides them through essential steps: setting up an account, connecting cloud and SaaS integrations, and linking workflows and version control systems. This process ensures Firefly can scan and inventory cloud assets, enforce guardrails in CI/CD pipelines, and become integrated into existing developer workflows.
Step-by-step guidance helps::
Connect cloud providers (AWS, Azure, Google Cloud, Kubernetes)
Integrate SaaS tools (Datadog, GitHub, GitLab, Bitbucket)
Set up notification channels (Slack, Microsoft Teams)
Scan and map inventory, compliance, and codified resources.
Firefly implements multiple, robust security measures to protect user data across its cloud management platform. These practices align with top industry standards and ensure both compliance and technical safeguards for sensitive cloud environments.
In transit: All data exchanged between Firefly and customer environments is encrypted using SSL/TLS (HTTPS), preventing interception during transmission.
At rest: Firefly encrypts stored data using strong standards such as AES-256, with secrets housed securely in systems like HashiCorp Vault and databases protected with managed keys.
Private cloud architecture: Firefly runs inside a virtual private cloud (VPC), restricting access to internal and backend systems via bastion hosts and internal networks.
Tenant isolation: Data is strictly isolated per customer, so that operations and processing are scoped to individual tenants, verified at every step.
Read-only permissions: Firefly commonly uses IAM roles or read-only access keys to scan cloud infrastructure, minimizing the risk of accidental changes or exposure.
Certifications: Firefly holds certifications such as SOC 2 Type II, ISO 27001, and aligns with GDPR and HIPAA frameworks, backed by regular third-party audits and annual penetration testing to validate its controls.
Audit trails: The platform offers comprehensive logs, traceable resource changes, and guards against configuration drift, supporting operational security and compliance reporting.
Firefly maintains detailed logging and real-time monitoring to detect, alert, and respond to potential threats, including proactive security checks within CI/CD workflows.
Regular penetration testing and security audits further validate and strengthen the platform’s protection mechanisms.
IAM integration: Integrates with cloud providers via IAM, ensuring access is limited to the least privilege necessary for operations, typically scanning configuration without accessing resource content.
Firefly releases platform updates on a monthly cadence, sharing new features, enhancements, and critical fixes as part of a structured product update cycle. Updates are managed in a way that emphasizes continuous improvement, automation, and minimal disruption for users, benefiting from modern SaaS operational practices.
The Firefly team posts monthly product updates, summarizing newly released features, integrations, and improvements over the previous 30 days.
Updates are continuously incorporated into Firefly’s hosted services, ensuring users always access the latest tools and protections without requiring manual intervention.
Updates, including enhancements to the Management Control Plane and integrations, are deployed centrally, so users of the hosted Firefly platform receive changes automatically.
Firefly’s Managed Cloud Platform architecture means end users do not need to handle local upgrades, server maintenance, or patch management—the infrastructure is kept current by Firefly’s product team.
System enhancements and security patches are integrated with minimal-to-no service downtime, leveraging DevOps best practices for reliability and operational consistency.
Monthly product roundups and update announcements provide transparency, with key changes summarized for users and administrators through Firefly’s site, blog, and communications.
Firefly’s policy on data ownership and portability ensures that customers retain full ownership and control over their data. Users can export, delete, or migrate their data as needed, and all personal and infrastructure data remains the property of the customer, not Firefly.
Firefly explicitly states that customers are the owners of any data they input or generate using the platform, including cloud infrastructure inventories, configurations, and associated metadata.
Firefly does not claim rights over user data beyond what is needed to deliver the service, and user data is not used for AI model training or for purposes outside of platform operations unless explicit consent is provided.
Owners can access, review, and request deletion of their content at any time, ensuring transparency and customer control.
Firefly enables users to export or transfer their data and configurations from the platform, facilitating migration between clouds, storage systems, or even to competitor solutions as needed.
Customers on enterprise plans can enforce custom data retention, choose region-specific storage, or utilize their own storage buckets for maximum data portability and compliance.
Firefly contracts usually operate with automatic renewal clauses and offer cancellation rights subject to specific notice periods and terms, consistent with industry SaaS practices.
Firefly subscriptions automatically renew for successive periods (Renewal Terms) after the initial contract duration unless terminated with proper notice.
Renewal periods can vary, but most SaaS contracts use annual, multi-year, or monthly terms for renewal length.
Customers must provide written notice—often 30, 60, or 90 days before the renewal date—to opt out of auto-renewal. Missing the window could result in being locked into another contract term.
Renewal notifications may not always be sent proactively, so tracking renewal timelines is essential for customers, especially in corporate settings.
Cancellation can typically be initiated via account management settings or by written notice; vendor requirements may prohibit phone cancellations, preferring email or platform-based processes.
Once canceled, services and features remain available through the current billing cycle; after this, accounts are downgraded or features restricted.
Data retention is generally maintained for a limited period after cancellation, giving customers time to export data before permanent deletion.
Early termination (before renewal end) may incur penalties or fees, depending on the specific contract and customer negotiations.
Firefly software meets several leading compliance standards relevant for security-conscious cloud operations and regulated industries. The platform is independently audited and built to support both technical and regulatory requirements.
SOC 2 Type II: Firefly is certified for SOC 2 Type II, ensuring strict controls around security, availability, confidentiality, and processing integrity. Regular annual audits validate these controls.
ISO 27001: Firefly aligns with ISO 27001, a globally recognized framework for information security management systems.
GDPR: The platform’s privacy handling adheres to the General Data Protection Regulation (GDPR), supporting data rights, residency, and breach notification requirements for users in the EU and globally.
HIPAA: Firefly incorporates privacy and security requirements aligned with HIPAA for sensitive healthcare data, for customers who require compliance in healthcare use cases.
PCI-DSS: Firefly provides policies and technical controls that can be configured to help organizations meet PCI-DSS standards for payment data, though full PCI compliance depends on customer implementation.
CIS Benchmarks & Policy Controls: Out-of-the-box, Firefly offers automated enforcement and continuous compliance policies based on CIS Benchmarks and other best practice guides.
Policy-as-Code engine automates enforcement of compliance rules, offering a library of prebuilt policies for SOC 2, PCI, HIPAA, ISO 27001, and CIS standards.
Continuous monitoring and audit trails provide real-time evaluation and evidence to support audit readiness.
