Security and trust

Strays looks at your AWS accounts, so you should know exactly what it can see, what it keeps, and how it's protected. This page is the detail your security team or auditor will ask for.

What Strays can access

• One read-only IAM role per AWS account, called strays-audit, which you create from our CloudFormation template or Terraform module. You can read every line first, on What Strays installs, with a checksum for each file and a reason for every permission.
• Only two named Strays roles can use it (the scanner and the web app's connection check, not the whole Strays account), and only with an external ID unique to your organisation (the defence AWS recommends against the "confused deputy" problem).
• Settings and metadata only. The role lists resources and their configuration, CloudTrail event history (to find who created something) and cost totals. It can't read the contents of objects, databases, secrets or parameters, and it can't create, change or delete anything. Two things to know: for three listing calls, AWS sends back more than Strays uses (Lambda environment variables and instance user data), and Strays reads only names, runtimes and image IDs from them and never keeps the rest; and the role can read your Terraform state only if you type a bucket name when you install it (off by default, that one bucket only; state files can hold sensitive values, so leave it empty if you'd rather not). Both are explained on What Strays installs. Every action is listed below; our tests fail if the role gains an action that isn't read-only or isn't needed.
• Remove access any time by deleting the stack: one click in the CloudFormation console, or one command. Strays can't delete the role. You remove it by deleting the stack, and access stops at once. See exactly what is installed.

If you connect them, Strays also uses: Slack (to message people and receive their button clicks; it can't read your channels), Microsoft Teams (to post to one channel through a webhook you create; it can't read the channel), Jira Cloud or Linear (to create tickets from findings, with a token you create; it only creates issues), and Microsoft 365 (read-only, to see who has been disabled or removed).

What Strays keeps

• Findings: resource IDs, names, tags, regions, configuration facts (for example "port 22 open to 0.0.0.0/0"), estimated cost, and the owner's email or IAM user name.
• Scan results: the same, as JSON, so every report can be rebuilt and compared over time.
• Your team: names, email addresses, roles; sign-in is handled by Amazon Cognito, so Strays never sees passwords or MFA secrets.
• Decisions: who kept, snoozed or fixed what, and when: the record auditors ask for.
• Billing: handled by Stripe. Strays never sees or stores card details.

Strays keeps findings and decisions while you're a customer, and each scan's full results for 400 days. An admin can delete your organisation and everything in it straight away in Settings → Your data, or ask us and we delete it within 30 days (backups expire within 35). See the privacy notice and data processing terms.

How it's protected

• Hosted in AWS London (eu-west-2). Serverless: no servers to patch or log into.
• Encrypted at rest with our own AWS KMS keys (database, scan storage, application logs, secrets; other logs use AWS-managed encryption), and in transit with TLS 1.2 or later everywhere. Slack tokens and other connection credentials are encrypted again with a key bound to your organisation.
• Behind a web application firewall with AWS's managed rules and rate limits; the app refuses requests that didn't come through it.
• Sign-in with MFA required for every user, 14-character minimum passwords, and sessions that expire after 12 hours. Staff access to the admin console needs a fresh password and MFA every 30 minutes.
• Secure by default in the browser: a strict content security policy, no third-party scripts or trackers, cookies that scripts can't read and other sites can't use to post forms as you.
• Tested before every release: automated tests covering every line of code, static analysis, dependency and infrastructure scanning, and a penetration test of new features.
• Backups: point-in-time recovery for the database (35 days); versioned storage.

Separation between customers

Every organisation is fully separate. The organisation is taken from the signed-in user's profile, never from what the browser sends; every record and file is stored under the organisation's ID; each organisation has its own external ID for its AWS roles; and a Slack workspace or Microsoft tenant can belong to only one organisation. Tests try to reach one organisation's data from another, by every route, before each release.

People and process

• Strays is built and run by Cloud Adept Limited, a UK company (number 09216333), founded in 2014, that builds and runs AWS for its clients.
• Production access is limited to named staff with MFA; every admin action is logged.
• Changes go through code review and the full set of automated checks; infrastructure is defined in Terraform.
• If a breach affected your data, we'd tell you without undue delay, and within 72 hours of becoming aware of it.

Sub-processors

The full list, with the safeguard for each transfer, is in our data processing terms. Slack, Microsoft Teams, Microsoft 365, Jira and Linear aren't our sub-processors: if you connect them, Strays sends to or reads from your own account, under your agreement with that provider (services you connect). Stripe takes payments for our own billing and doesn't receive the data Strays finds in your accounts.

Reporting a vulnerability

Email support@getstrays.com with "Security" in the subject. We'll acknowledge it within two working days (ordinary support emails get a reply within one) and keep you updated; please give us a reasonable time to fix it before telling anyone else. Don't access other customers' data or disrupt the service while testing. Our security.txt has the same details.

Every permission the role has

All read-only (Describe, Get, List, Lookup, Search, View; and GenerateCredentialReport, which asks IAM to prepare its user report), grouped by AWS service. This list is generated from the role template itself. See each one with the reason Strays needs it.

Questions from your security team, or need our answers to a security questionnaire? Email support@getstrays.com.