Integrations
Read-only by default. Isolated per client.
Connectors ask for the minimum read permissions, never write to your environment, and never fall back to fake data when credentials are missing.
Microsoft Entra ID & 365
App registration, Microsoft Graph, application permissions
- MFA registration coverage
- Privileged role membership
- Inactive accounts (90+ days)
Microsoft Azure
Entra app + Reader role, Azure Resource Manager
- Storage account encryption and public access
- Microsoft Defender for Cloud assessments
Amazon Web Services
Cross-account IAM role (recommended) or access key
- S3 encryption and public access
- CloudTrail logging
- AWS Backup plans and jobs
- Security Hub findings
How connections behave
Honest about what is real
Where a real connector is configured, the check is marked LIVE. Where it isn't, the same check runs against demo data and is marked MOCK. A missing credential produces a clear error, never a quietly green result.
- Least-privilege, read-only permissions documented per connector
- Secrets stored by reference to a secret manager — never in the database
- Per-workspace credentials: one client's connection can never serve another
- Connection test before any check relies on it
- Cross-account role assumption on AWS so you never share a long-lived key
Roadmap Intune, GitHub, Google Workspace, Okta and endpoint-agent connectors. Not available yet.
See your real compliance posture, not a spreadsheet of it.
Book a walkthrough and we'll run the checks against a sample environment so you can see every verdict traced back to its evidence.