Security & Trust

Trying the free scan? Parsivex needs read-only access to your AWS account to find waste. Here is exactly what that means — what we can see, what we never touch, and how you stay in control.

Read-only IAM role

You create a role in your AWS account with Describe, Get, and List permissions only. Parsivex cannot create, modify, or delete any resource.

Revoke access anytime

Delete the IAM role in your AWS console and access ends immediately. No waiting period and no support ticket required.

No credit card for the free scan

The free scan is one scan per AWS account at no cost. We only ask for payment if you choose a paid plan.

No long-term AWS credentials

We store only your Role ARN and External ID. When we scan, we call AWS AssumeRole for temporary credentials that expire within one hour.

Security help center

Expanded guides on data access, revocation, and common security questions live in our help center. The IAM policy JSON below remains the canonical reference.

Browse all AWS access articles in the help center.

What Parsivex can — and cannot — do

Can see: AWS billing aggregates, resource inventory metadata, and CloudWatch metrics
Cannot see: Application data, secrets, S3 object contents, or environment variables
Cannot do: Create, modify, or delete any AWS resource

Read-only IAM role with External ID protection

You create a read-only IAM role in your account and grant Parsivex permission to assume it
The role is locked to the minimum permissions required — no write access, ever
We use an External ID (a secret token unique to your account) to prevent confused-deputy attacks — even if someone knows our AWS account ID, they cannot assume your role without the External ID
You can revoke access instantly by deleting the IAM role — we lose all access immediately

After your free scan

Many free-scan users ask what happens once the scan finishes. You stay in control:

Your IAM role stays in your AWS account and the connection remains in Parsivex so you can upgrade or run another scan later — nothing changes automatically
On the free plan, you get one scan per AWS account for the lifetime of your account. We do not run additional scans unless you start one or upgrade to a paid plan
You can revoke access at any time by deleting the IAM role in AWS. Access ends immediately and no new data is collected
Revoking AWS access stops future scans but does not delete past scan results in Parsivex — delete your account from Settings if you want that data removed too

What we store — and what we don't

We store

Role ARN and External ID for your AWS connection
Scan results — aggregated cost data, findings, and estimated savings
Generated report PDFs (paid plans)
Account profile (name, email) and support correspondence

We never store

Long-term AWS credentials or access keys
S3 object contents, application secrets, or SSM parameters
Raw billing line items beyond what is needed for your scan report
Payment card numbers (Stripe handles billing data directly)

Full details in our Privacy Policy and Terms of Service.

Data retention

Revoking AWS access stops new scans immediately. Existing scan data stays in your Parsivex account until you delete your account.

Data type	While connected	After revoking AWS access	After account deletion
Scan results and findings	Retained	Retained until account deletion	Permanently deleted
Report PDFs	Retained	Retained until account deletion	Permanently deleted
AWS connection (Role ARN, External ID)	Retained	Removed if you delete the connection	Permanently deleted
Chat conversations (paid plans)	Retained	Retained until account deletion	Permanently deleted
Email delivery audit log (recipient addresses)	Retained (90 days)	Retained (90 days)	Permanently deleted

Deleting your Parsivex account does not remove the IAM role from AWS — delete that separately in the IAM console. See revoking access for step-by-step instructions.

IAM policy

This is the exact read-only policy attached to the role you create:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "CostExplorerReadOnly",
      "Effect": "Allow",
      "Action": [
        "ce:Get*",
        "ce:Describe*"
      ],
      "Resource": "*"
    },
    {
      "Sid": "CloudWatchReadOnly",
      "Effect": "Allow",
      "Action": [
        "cloudwatch:Get*",
        "cloudwatch:Describe*",
        "cloudwatch:List*"
      ],
      "Resource": "*"
    },
    {
      "Sid": "CloudWatchLogsReadOnly",
      "Effect": "Allow",
      "Action": [
        "logs:Describe*",
        "logs:List*"
      ],
      "Resource": "*"
    },
    {
      "Sid": "EC2ReadOnly",
      "Effect": "Allow",
      "Action": [
        "ec2:Describe*"
      ],
      "Resource": "*"
    },
    {
      "Sid": "RDSReadOnly",
      "Effect": "Allow",
      "Action": [
        "rds:Describe*"
      ],
      "Resource": "*"
    },
    {
      "Sid": "ElasticLoadBalancingReadOnly",
      "Effect": "Allow",
      "Action": [
        "elasticloadbalancing:Describe*"
      ],
      "Resource": "*"
    },
    {
      "Sid": "ElastiCacheReadOnly",
      "Effect": "Allow",
      "Action": [
        "elasticache:Describe*"
      ],
      "Resource": "*"
    },
    {
      "Sid": "RedshiftReadOnly",
      "Effect": "Allow",
      "Action": [
        "redshift:Describe*"
      ],
      "Resource": "*"
    },
    {
      "Sid": "EFSReadOnly",
      "Effect": "Allow",
      "Action": [
        "elasticfilesystem:Describe*"
      ],
      "Resource": "*"
    },
    {
      "Sid": "DynamoDBReadOnly",
      "Effect": "Allow",
      "Action": [
        "dynamodb:ListTables",
        "dynamodb:DescribeTable"
      ],
      "Resource": "*"
    },
    {
      "Sid": "LambdaReadOnly",
      "Effect": "Allow",
      "Action": [
        "lambda:Get*",
        "lambda:List*"
      ],
      "Resource": "*"
    },
    {
      "Sid": "S3BucketReadOnly",
      "Effect": "Allow",
      "Action": [
        "s3:GetBucket*",
        "s3:List*",
        "s3:ListBucketMultipartUploads",
        "s3:ListMultipartUploadParts"
      ],
      "Resource": "*"
    }
  ]
}

FAQ

Contact

Questions? Email us at hello@parsivex.com — we're happy to walk through the access model on a call.