How connections work
Connecting your infrastructure to a compliance tool is an act of trust. Here is exactly what Compscan can see, what it can never do, and how you stay in control — in plain language.
Read-only, always
Every connection is strictly read-only. Compscan is technically incapable of creating, modifying, or deleting resources in your accounts — the permissions we request simply don't allow it. Suggested fixes are proposed as pull requests that you review and merge.
Least privilege
We request only what each available connector actually calls: AWS SecurityAudit or repository-scoped read permissions. Azure and GCP are coming soon, so ScanComb does not request their credentials today.
Dedicated, revocable identities
AWS is keyless: Compscan assumes your cross-account role with a unique External ID. GitHub and GitLab use dedicated, repository-scoped credentials that are encrypted at rest, never returned to the browser, and revocable from the provider.
Provable, not just asserted
AWS setup includes reviewable CloudFormation and Terraform. The generated role grants AWS SecurityAudit and requires your unique External ID before ScanComb can assume it.
You stay in control
You choose the scope: which regions, accounts, and repositories are visible. You can disconnect from Compscan with one click, or revoke from your own side (delete the IAM role, revoke the token) — access stops instantly either way, and stored connection material is deleted.
Isolated per tenant
Connections are isolated per tenant and enforced server-side — one customer's connection can never be used to read another's account. Provider credentials are stored only for that integration, and authorization is checked again before connection management and sync actions.
Access model by provider
| Provider | Availability | Runtime access | Scope | Provider-side revocation |
|---|---|---|---|---|
| AWS | Available | Cross-account role + External ID | Account and selected regions | Delete role |
| Azure | Coming soon | No credentials requested | — | — |
| GCP | Coming soon | No credentials requested | — | — |
| GitHub | Available | Fine-grained PAT: Metadata, Administration, Contents (read) | Selected repositories | Delete token |
| GitLab | Available | Reporter + read_api + read_repository | One project (recommended) | Revoke token |
What Compscan never accesses
- — Your application data, S3 object contents, or database contents.
- — Secrets, keys, or credentials stored in your accounts.
- — Your source code, beyond the infrastructure-as-code files (e.g. Terraform) in repositories you explicitly select for scanning.
- — Anything with write access: no pushes, no config changes, no deletions.
And you don't have to connect anything to see the product working: the readiness check and compliance advisor are open — connect only once you're convinced.