Trust
Honest controls — no fake SOC 2 badges. What we do, what we never do.
You deploy a CloudFormation stack that creates an IAM role. Rectifyr calls sts:AssumeRole with ReadOnlyAccess-style permissions for the duration of a scan. We do not ask for, and do not store, long-lived access keys from your account.
Configuration and metadata needed for cost and security findings (instances, security groups, bucket public-access settings, WAF associations, IAM MFA status, and similar). We do not read object contents in S3, database rows, or application payloads.
You do. Interactive scans start when you click Find savings in the product. Scheduled scans only apply to connections you have already authorized as active.
Account email and scan metadata live in Supabase with row-level security so users only see their own connections, scans, and findings. Traffic to the API uses HTTPS in production.
Delete or deny the IAM role in your account and Rectifyr can no longer AssumeRole. Sign out and disconnect in the app to clear local connection state.
Security reviews for Activate or design partners: Contact · Privacy