Quick answers to the security questions we hear most — especially from teams trying the free scan before they have a billing relationship with us. Parsivex connects through a read-only IAM role you create in your AWS account. You can revoke access anytime by deleting that role. For the full access model and canonical IAM policy JSON, see Security & Trust.
For a detailed breakdown of what Parsivex reads from AWS, see What data can Parsivex see?.
Trying the free scan?
The free scan is one scan per AWS account, per lifetime — no credit card required. You grant read-only access, we run the scan, and you see your total estimated monthly waste plus a findings count. Individual finding details and remediation steps are available on paid plans only (see Free tier limits).
After the scan finishes:
- Your IAM role stays in your AWS account and the connection remains in Parsivex — nothing changes automatically
- We do not run additional scans on the free plan unless you start one manually (your one lifetime scan is the limit)
- You can revoke access anytime by deleting the IAM role in AWS — access ends immediately
- Your scan results stay in Parsivex until you delete your account, even after you revoke AWS access
See Revoking Parsivex access for step-by-step instructions.
Can Parsivex see my application data or secrets?
No. The IAM policy does not grant access to S3 object contents, Secrets Manager, SSM Parameter Store, or any service that stores application data. We see resource metadata and metrics — for example, that an S3 bucket exists and how large it is — but not the files inside it.
Can Parsivex make changes to my infrastructure?
No. All actions in the policy are read-only (Describe*, Get*, List*). There are no write permissions. Parsivex cannot create, modify, or delete any AWS resource. Remediation scripts are generated for you to review and run locally — Parsivex never executes them on your behalf.
How do I revoke access?
Delete the IAM role from your AWS console. Access is revoked immediately and permanently until you create a new role. See Revoking Parsivex access for step-by-step instructions and what happens to your data.
Is my billing data stored?
We store scan results — aggregated cost data and findings — to generate your report. We do not store raw billing line items beyond what is needed for report delivery. We never store long-term AWS credentials; we keep only the Role ARN and External ID for your connection. Revoking AWS access stops new data collection but does not delete existing scan history. See our Privacy Policy for the full retention table.
What is an External ID?
The External ID is a secret token unique to your Parsivex account. It is required in your IAM role trust policy to prevent confused-deputy attacks — a scenario where a third party tricks Parsivex into accessing the wrong AWS account. Even if someone knows the Parsivex AWS account ID, they cannot assume your role without your External ID.
Do you store my AWS credentials?
No. Parsivex stores only the Role ARN and External ID for each connection. When we need to access your account, we call AWS AssumeRole to obtain temporary credentials that expire after one hour. We never have or store long-term credentials for your AWS account.
Data retention
| Data type | Retained while connected | After revoking AWS access | After account deletion |
|---|---|---|---|
| Scan results and findings | Yes | Yes, until you delete your account | Permanently deleted |
| Report PDFs | Yes | Yes, until you delete your account | Permanently deleted |
| AWS connection (Role ARN, External ID) | Yes | Removed if you delete the connection in Integrations | Permanently deleted |
| Chat conversations (paid plans) | Yes | Yes, until you delete your account | Permanently deleted |
| Email delivery audit log (recipient addresses) | Yes (90 days) | Yes (90 days) | Prior logs deleted; deletion confirmation retained 90 days |
Scheduled scans stop immediately when AWS access is revoked. No new data is collected after the IAM role is deleted.
Where is data stored?
Parsivex stores your data in secure, managed cloud infrastructure. Scan results, findings, account settings, and generated PDF reports are encrypted in transit (TLS) and at rest. We do not sell your data or replicate your AWS resource information to third-party analytics or advertising platforms.
Account deletion
Deleting your Parsivex account permanently removes:
- All workspaces, scans, reports, and findings in accounts you solely own
- AWS connection records (Role ARN and External ID)
- Chat conversations and messages
- Email delivery audit records tied to your address or workspaces you solely own (except the deletion confirmation email — see below)
- Your user profile and login credentials
If you are the only member of a team account, the entire account and its data are deleted. If you share an account with other members, you are removed as a member but the team's data is preserved.
Active Stripe subscriptions are cancelled immediately with no refund.
After deletion completes, we send a confirmation email to the address on your account. This is a one-time transactional message so you know the deletion succeeded — and so you can contact support if you did not request it. A record of that confirmation email is retained in our delivery audit log for 90 days, then removed automatically.
Account deletion does not remove IAM roles from your AWS account. After deleting your Parsivex account, go to IAM → Roles in the AWS console and delete the Parsivex role to fully revoke access.
To delete your account, go to Account (/settings/account) and scroll to Danger zone → Delete account.
Where is the IAM policy?
The current IAM policy JSON is always available on our Security & Trust page. Use that page when setting up or updating your role — it is the authoritative copy and stays in sync with the policy shown during onboarding.
Still have questions?
Email us at hello@parsivex.com — we are happy to walk through the access model on a call.