S1Security

Read-only. Revocable.

How we connect to your cloud, what we can see, and what we do with your data. No marketing — just the technical details.

TL;DR

Read-only access. We cannot modify, delete, or write anything in your AWS account.
3 API permissions. We call ec2:Describe*, s3:ListAllMyBuckets, and sts:GetCallerIdentity. Nothing else.
No stored credentials. We use AWS STS AssumeRole with 15-minute session tokens. No access keys are stored.
You can revoke access in 10 seconds by deleting the IAM role from your AWS console.

How AWS connection works

We use the industry-standard cross-account AssumeRole pattern. This is the same mechanism used by AWS organizations, Datadog, Prisma Cloud, and every major cloud tool.

You create an IAM role in your account

The role trusts our broker account (590183704419) with a unique External ID tied to your session. This prevents confused deputy attacks.

We assume the role with a 15-minute session

Our broker calls sts:AssumeRole with DurationSeconds=900 (15 minutes). The temporary credentials expire automatically.

We run read-only API calls

Count EC2 instances, list S3 bucket names, verify account identity. We cannot read bucket contents, modify resources, or access any other service.

Session expires, credentials are discarded

After the scan completes, the temporary STS token expires. We do not cache or persist AWS credentials.

Exact permissions we request

Permission	What it does	What it cannot do
ec2:Describe*	Count instances, list regions, read instance metadata	Cannot start, stop, terminate, or modify any instance
s3:ListAllMyBuckets	Count bucket names	Cannot read, download, delete, or list objects inside any bucket
sts:GetCallerIdentity	Verify we are in your account (returns account ID and ARN)	Cannot assume other roles or escalate privileges

You can verify every API call we make by checking your CloudTrail logs.

What we store

Scan results

Instance count, bucket count, region list, risk flags, and generated insights. Stored as JSON attached to your session record. No raw AWS API responses are persisted.

Scan history

Up to 5 previous scan snapshots for trend comparison. Older snapshots are automatically dropped.

IAM Role ARN

The Role ARN and External ID you provided, encrypted at rest using AES-256-GCM. Used to re-assume the role for subsequent scans. Deleted when you disconnect.

What we never store

- AWS access keys, secret keys, or session tokens
- Contents of S3 buckets or EBS volumes
- Application logs, environment variables, or secrets
- IAM user credentials or root account information

Data retention

Data type	Retention
Scan results & insights	While your account is active. Deleted on request.
Scan history (comparisons)	Last 5 snapshots. Oldest auto-deleted.
Encrypted Role ARN	Until you disconnect. Immediately deleted on disconnect.
STS session tokens	Never stored. Used in-memory only. Expire after 15 minutes automatically.

How to revoke access

Delete the IAM role from your AWS account. That's it. We can no longer assume the role and all future scan attempts will fail.

AWS Console → IAM → Roles → Find the CloudOperator role → Delete

Or via CLI: aws iam delete-role --role-name CloudOperatorReadOnly

Compliance & certifications

We are transparent about where we are in our compliance journey:

Encryption: TLS 1.2+ in transit. AES-256-GCM at rest for credential storage.
Infrastructure: Hosted on Vercel (SOC2 certified) with PostgreSQL on managed infrastructure.
DPA: Available for enterprise clients on request.
SOC2 / ISO 27001: Not yet certified. We follow SOC2-aligned practices (least privilege, audit logging, encryption at rest) and will pursue formal certification as we scale.

Verify our claims

You don't have to trust our word. Here's how to verify independently:

CloudTrail: Check your CloudTrail Event History for all API calls made by the assumed role. You'll see only DescribeInstances, ListBuckets, GetCallerIdentity, and DescribeRegions.
IAM policy: Review the inline policy on the role you created. It contains exactly the 3 permissions listed above.
CloudFormation template: The Launch Stack template is open — read it before deploying. It creates one IAM role, nothing else.

Questions?

If you're running a vendor security review, we're happy to answer a security questionnaire or get on a call.

Contact security team