CloudTruth
CloudTruth (Sigma) · Coding
CloudTruth is a config data platform that keeps parameters, secrets, and certificates versioned in one place and syncs them to Terraform, Kubernetes, and CI. An AI Copilot drafts the templates.
About CloudTruth
What Is CloudTruth
CloudTruth is a configuration and secrets data automation platform, now sold under the Sigma Config name. It holds parameters, API keys, certificates, and environment variables in a single versioned store, then serves them to builds, deployments, and running applications. Teams use it to stop copying values between repos, cloud vaults, and pipeline settings.
The problem it targets is config sprawl, the state most configuration management advice quietly assumes away. One service ends up with values in a Git repo, a .env file, AWS Parameter Store, and a CI dashboard, and nobody can say which copy is live. CloudTruth connects to those sources instead of forcing a migration, so a value can stay in AWS Secrets Manager, Azure Key Vault, HashiCorp Vault, or a Git repo and be referenced from one place.
The limits matter before you sign up. Pricing is quote based, governance controls such as protected environments sit in the business tier, and the initial setup assumes someone on the team understands your Terraform or Helm layout. A solo developer running one small app will find it heavier than a managed secret store.
Getting Started
- Create an account and start the free trial. No credit card is required.
- Connect an integration, for example AWS SSM, AWS Secrets Manager, Azure Key Vault, Vault, or GitHub, using read-only credentials.
- Create a project and add parameters or secrets. You can also import existing files in JSON, YAML, HCL, TF_Vars, or INI.
- Add environments such as dev, staging, and production, then set overrides where values differ.
- Consume the values through the CLI, the Terraform provider, the Kubernetes operator, or the REST API.
Product Information
A quick look at CloudTruth's pricing, supported platforms, and performance.
Best for
The users, tasks, and scenarios where this tool fits best.
Users
- Platform and DevOps engineers
- SRE teams
- Security and compliance leads
- Backend developers shipping to several environments
Tasks
- Rotating secrets on a schedule
- Keeping Terraform config and Kubernetes config aligned
- Auditing who changed a value
- Drafting config templates with AI
Scenarios
- Multi-environment deployments
- Incident response after a key leaks
- Adopting config as code without rewriting applications
- SOC 2 preparation
Key features
One Versioned Store for Config and Secrets
Parameters, secrets, and certificates live together with full history, so secrets management and parameter management share one record. You can compare versions, restore an earlier value, and see which environment used it. The point is a single answer to the question of what a service is actually running with.
AI Copilot for Templates and Fixes
The Copilot writes config templates from a prompt, generates variables with descriptions and default values, imports structured data, and repairs syntax problems in existing templates. It also checks a template against well-architected frameworks and known configuration vulnerabilities. CloudTruth states that the Copilot does not share your configuration data with outside parties.
Templates, Inheritance, and Overrides
Define a value once at the project level, inherit it in every environment, and override only where it differs. That cuts the number of places a change has to be repeated, which is where most misconfigurations come from.
External Values Without Migration
Values can stay in AWS Secrets Manager, Azure Key Vault, HashiCorp Vault, SSM, or a Git repo and be referenced from CloudTruth. You get central visibility and access control without moving sensitive data into a new database.
Scheduled Secret Rotation
Rotation runs on a schedule for supported secret types, so a leaked key gets replaced without a manual runbook. Short-lived certificates become practical when renewal is automated.
Access Control and Audit Trail
Role-based access control, SSO with SAML, and per-project restrictions decide who can read or change a value. The audit log records the change, the user, and the time, which is the record compliance teams ask for.
Toolchain Integrations
Over 30 integrations cover Terraform, Kubernetes, GitHub, ArgoCD, AWS, Azure, and common CI systems, with a CLI and REST API for anything not on the list. Most teams connect their existing tooling rather than replace it.
Pros and cons
Pros
- Values can stay in the stores you already run, so adoption doesn't require a migration project.
- The Copilot turns a short prompt into a usable variable set with descriptions and defaults.
- Change history plus RBAC covers most of the evidence a security review asks for.
- A self-hosted option exists for teams that can't send config data to a vendor.
Cons
- No published price list, so you need a sales conversation before you can budget.
- Copilot output still needs a review pass, and a wrong default can reach production if nobody checks.
- The setup assumes IaC knowledge, which makes it a poor fit for a single small app.
Frequently asked questions
It stores configuration values and secrets in one versioned place and delivers them to your build, deploy, and runtime tools. The practical result is that a service reads one source instead of four copies.
Related content
Explore related tools, skills, and articles for CloudTruth.
CloudTruth Alternatives
Base Code
Base44 (Wix) · Coding · ProductivityBase Code is a shared cloud development environment from Base44. Teammates describe changes to an existing GitHub codebase in chat, preview them live and send them back as pull requests.
Google EmbeddingGemma 2
Google DeepMind · Writing · Image · CodingGoogle EmbeddingGemma 2 is a 740M-parameter open model that turns text, code, images, audio, and video frames into vectors in one 768-dimension space, running on phones and laptops.
GitGlow
GitGlow · Coding · ProductivityGitGlow is a local-first desktop Git client that lets independent developers review their own code and their AI agents' changes in one place before shipping.