Security & Privacy
What GovIntel never holds
No AWS credential, and no data-plane content, because the role denies those reads outright rather than merely declining to make them.
No AWS credential of yours
No access key, no secret, no session token that outlives a run. Access is federated and short-lived, and there is no credential to store, rotate or leak.
No data-plane content
Not because GovIntel chooses not to read it, but because the role denies it:
| Never read | Denied |
|---|---|
| Object contents | Object retrieval and enumeration |
| Database records | Item, query and scan operations |
| Secrets and parameters | Secret retrieval, parameter retrieval, and parameter history |
| Cryptographic material | Decrypt, data key generation and re-encryption |
| Log and stream content | Log event retrieval, log queries, queue and stream reads |
| Code and images | Function package retrieval, function invocation, container image retrieval |
A deny in IAM overrides every allow, including those inherited from the managed policies. This is a property of the access rather than a policy GovIntel follows.
No standing access
Between assessments, GovIntel can do nothing in your account. There is no persistent session, no scheduled job, no agent and no network path inbound.
GovIntel also cannot look into your account to see whether the role exists. That is why account discovery runs with your credentials and reports back, rather than GovIntel checking for itself.
No lateral movement
The role is denied the ability to assume other roles or pass roles. It cannot become anything other than itself.
An honest correction
An earlier version of GovIntel's marketing claimed "zero data extraction". That was false: control results, posture, cost figures and configuration do leave the account, because that is the assessment.
The true claim is narrower and stronger, and it is the one above: no data-plane content is read, because the role denies it.