Beta · Sovereign cloud operations
Your forward deployed security and cloud operations team, inside your own Azure. Beta
Watchtower is a sovereign alternative to the security, monitoring and cost tools and the managed services you'd otherwise pay for, and give access to your cloud. It runs entirely in your own subscription and works around the clock. Every fix comes to your team as a pull request to approve.
Beta: provided as is. See the Watchtower Beta Terms.
Why Watchtower
Replace the stack, keep control.
Keeping a cloud reliable, secure and affordable usually means several SaaS tools (posture management, monitoring, cost management) plus a managed-services or consulting retainer. Each is another vendor with standing access to your cloud and copies of your data, another contract and another security review. Watchtower does that work in one place you own:
- no outside platform holding your cloud credentials or your data;
- no retainer or billable hours;
- a one-time licence, with an optional monthly service.
How it works
Method, expertise, technology and AI, in one place.
Capacity (AI Workforce)
Investigates every alert, sweeps for exposure and drift, and prices waste, every hour of every day.
Method
Established practice built into every finding: root-cause analysis, continuous posture review, FinOps review, change impact analysis.
Technology
Software that runs in your subscription and uses your own AI model resource in Azure and your GitHub.
Expertise
Expert hours included with the monthly service, and Judgement as a Service when a decision needs a person.
What it does
Work that never stops.
Incident response (root-cause analysis)
Each alert becomes a GitHub issue with the evidence, the likely cause, what else is affected, and a fix tested as a dry run.
Security and drift (continuous posture review)
Exposure, configuration drift and live changes made outside your code, with who made each change. Results go to your security tab and your security monitoring tools.
Cloud cost (FinOps review)
Waste and right-sizing with labelled savings estimates, and what has been fixed since the last scan.
Change review (impact analysis)
A comment and a check on every infrastructure pull request showing what the change would touch.
Ask it from your AI assistant (MCP connector)
Connect your assistant to your install's own connector address and ask about incidents, exposure and spend. The connection goes straight to your install.
Your people stay in charge
Nothing changes without your approval.
- Read-only access that you grant and can revoke at any time.
- Nothing changes without a pull request you approve.
- Covers Azure subscriptions, AWS accounts and GCP projects.
Your data
What stays in your Azure, and what doesn't.
Stays in your subscription
- Watchtower's software, the map it builds of your cloud, and every finding.
- Your cloud access, through read-only grants that you create.
- Every AI model call, made to your own AI model resource in Azure.
Goes to your GitHub
- Issues and pull requests, in the repositories you choose.
Crosses to us
- Your licence check.
- Signed updates, which your install downloads and verifies itself.
- A health signal (up to date, healthy).
- Short-lived GitHub access, issued through our GitHub App.
- Credentials we issue for your install at activation (an API token, an alert token and a webhook key), which our console uses to read your reports.
- When you open a report in our web console, it's fetched from your install to show it to you.
What we can't do
- We have no access to your subscription.
- We can't read your cloud credentials or your AI key.
- Your install runs only releases we have signed.
How it starts
Three steps, in your own subscription.
- 01
Buy and connect GitHub
Buy the licence on Azure Marketplace or by card (Azure Marketplace is coming soon), then install our GitHub App on your incident repository and the repositories that define your infrastructure.
- 02
Deploy into your subscription
Deploy Watchtower into a new resource group in your subscription. The first run takes 20 to 40 minutes.
- 03
Grant access
Grant read access to the subscriptions it should watch and connect your AI model resource in Azure. Reports, issues and pull requests start arriving.
Pricing
A one-time licence, with an optional monthly service.
Licence: $199, one time. Watchtower in your own Azure: every feature, any number of cloud accounts, no subscription required.
Optional service (monthly, cancel any time):
Standard
$99/month
New releases as they ship; support with a first response within 1 business day (business hours, Monday to Friday; email and portal); 1 expert hour a month.
Premium
$199/month
New releases; support with a first response within 4 hours (1 hour for a production outage), 24x7 for outages; email, portal, phone and a named engineer; 4 expert hours a month.
Unused hours don't roll over.
Without the service, your install keeps running on the version you have and keeps reporting in the console. New GitHub issues and pull requests need an active service.
Common questions
Before you start.
- Does Watchtower change my infrastructure?
- Only through pull requests you approve.
- What leaves my subscription?
- Only what is listed under Crosses to us and, in your own GitHub, the issues and pull requests.
- Which clouds does it cover?
- Azure, AWS and GCP.
- How do I stop?
- Cancel the monthly service at any time in Stripe or Azure Marketplace. To remove Watchtower, delete its resource group.