Security
Security and your data
GuardKite reads how your AWS accounts are configured, never what is in them. This page covers what it can reach, what it keeps and for how long, and how to take it all back.
Access to your AWS account
GuardKite works through a single IAM role that you create in your own account, with a CloudFormation stack. The role carries AWS's read-only SecurityAudit and ViewOnlyAccess policies plus a few further Describe, List and Get actions. It cannot create, change or delete anything.
It reads how resources are configured, not what they contain: not the objects in your S3 buckets, the values of your secrets, or the data in your databases.
GuardKite never holds keys to your account. It assumes the role for temporary credentials that expire within the hour. The role trusts only GuardKite's own scanning roles, and only when they present an External ID unique to your organization, so no one else can use it.
The exact permissions are documented for your security reviewer: what GuardKite needs from your account and the cross-account IAM role.
What GuardKite stores
- The configuration data read during each daily scan.
- What GuardKite builds from it: findings and their history, attack paths, IAM risk and change events, and the decisions your team records, such as accepting the risk on an attack path.
- Your team's GuardKite accounts: names and email addresses, and passwords stored only as salted hashes when you don't sign in with single sign-on.
Where and how it is stored
Scan data, meaning the configuration data and everything built from it, is stored in AWS, in the EU (Ireland).
Scan data is encrypted at rest and in transit.
How long it is kept
- Configuration data: 365 days.
- Finding history: 365 days.
- Current findings: replaced by each day's scan, so they always reflect your account as it is now.
Taking it back
Revoke access at any time by deleting the CloudFormation stack, or the role itself, in your AWS account. Access ends at once, and nothing on GuardKite's side can restore it.
Disconnect an account in GuardKite and its findings, finding history, attack paths, IAM data and configuration data are deleted within about an hour. Backup copies are removed within 90 days.
Remove a teammate and an organization admin deletes their GuardKite account.
Signing in
Your team can sign in with Google or Microsoft, or through your own identity provider with SAML 2.0 single sign-on, set up per organization. Email and password sign-in is available too.
Reporting a vulnerability
If you believe you have found a security issue in GuardKite, email [email protected]. Please give us a reasonable time to fix it before sharing it publicly. Our security.txt has the same details.