From Governator to Cloudivence: When an Internal Azure Tool Becomes a Product

In this article

• It started with our own questions
• The important property became evidence
• Why we did not simply rename Governator
• What Cloudivence is today
• A narrower focus to start with
• What comes next

Governator started as internal tooling. It was never designed around a marketing name, a self-service onboarding flow or a public SaaS product. It existed because we needed better answers from Azure environments than we could get by reading individual dashboards one at a time.

Over the last year the scope changed. Cost reconciliation, allocation history, security observations, access and compliance evidence started to share the same underlying model. At that point Governator stopped being just a tool.

That also exposed a problem. Governator is a good engineering codename. It is not the name we want an Azure administrator to read on a consent screen before granting access to a production tenant.

So the engine stays Governator. The product built around it becomes Cloudivence.

It started with our own questions

The first version answered security and compliance questions: which resources are exposed, who holds which role, which CyFun and NIS2 controls have evidence behind them. The data was all in Azure already. Joining it was the work.

Then the cost questions arrived, and they turned out to be harder than the security ones. Azure is often bought through a CSP reseller, and the monthly invoice does not look like what the Azure portal shows. Discounts apply to some charges and not to others. Reservations are paid by one subscription and used by another. Resource groups change owner in the middle of a year, and the spreadsheet that maps them to cost centres only ever knows its current state.

Answering “how much did this cost centre spend in March?” properly meant keeping the invoice as received, reconciling it with Azure’s own cost data, applying the ownership that was valid in March, and being able to show every step.

The important property became evidence

For a while we thought the value of Governator was the number of things it could assess. It was not. The property that kept proving useful was simpler to state and harder to build: being able to explain where a conclusion came from.

For a cost figure, that chain runs from the reseller’s invoice, through Azure cost data and the authoritative ownership mapping, to the allocation and finally the reported figure. For a governance finding it runs from the Azure configuration, through the collected evidence and the assessment rule, to the finding and back to its source.

The recurring question became less “what does the dashboard say?” and more “can I prove why it says that?”

That is also where the new name comes from. Cloud, and the evidence behind it.

Why we did not simply rename Governator

Renaming an established codebase because the product needs a new name gives very little value and a lot of risk. Governator keeps its repository, its collectors, its rules and evidence processing, and its engineering history.

Cloudivence becomes everything a customer sees:

• the application and its branding
• the website
• the documentation
• the trust and security model
• in time, the Microsoft Marketplace listing

Cloudivence is the product boundary around the technology that already exists, with the same code underneath.

GenioCT BV stays the company that builds and publishes it. The separation keeps the consulting work and the product apart without pretending the product came from nowhere.

What Cloudivence is today

Describing the current state accurately counts for more than the name.

The first Cloudivence deployments are assisted pilots. We agree the scope and the read access with each organisation and work through one or two closed months together.

Self-service onboarding needs more engineering. Part of it exists, as operator tools rather than something a customer clicks through:

• hosting: one Azure cell in West Europe is designed, and is provisioned when the first pilot needs its data hosted
• customer credentials through the Cloudivence application, by certificate or federated identity, so none of our people ever log in on someone else’s behalf. The code is there, the multitenant application registration is not yet
• an explicit Azure role assignment step after consent, because consent alone gives no access to subscriptions. An access check already shows what was given and what is missing
• a tenant lifecycle: suspension, disconnection and deletion with a deletion record exist as operator commands
• isolation we can demonstrate: each tenant has its own schema and its own access rights, and permission checks on every read are still being finished

Invoice reconciliation is supported today for one CSP reseller’s workbook format. Other formats will be added as adapters, when a customer needs them.

The goal is straightforward. An Azure administrator should be able to see exactly what Cloudivence wants to read, give it only those permissions, and get useful results without a consulting project around the onboarding itself.

A narrower focus to start with

Cloudivence does not start as another general security dashboard. It focuses first on organisations whose cloud figures have to be defensible:

• Azure bought through a CSP, with an invoice that needs reconciling
• costs allocated to internal cost centres, with ownership that changes over time
• a monthly close, and someone who asks where a number came from
• governance and compliance evidence, often under European regulation

Security and access remain part of the platform, because they rest on the same facts. But the first proposition is making cloud cost and governance information traceable enough that somebody can actually defend it.

What comes next

Governator isn’t disappearing, and very little of the engineering needs to change name at all. What changes is the boundary around it.

The next work is less glamorous than choosing a name: hosting, customer identity, Azure permissions, tenant lifecycle, data isolation, and a trust page that says exactly what the platform reads and why. That work will decide whether Cloudivence becomes useful beyond the environments where Governator was first built.

The new home is cloudivence.com. For now, external deployments are assisted pilots. If you would like to try it on your own Azure bill, request a pilot.