emfirge Security

01 Access

Read-only by design

No write permissions. Emfirge never modifies, deletes, or creates anything in your AWS account.

You deploy the role. A CloudFormation template creates a read-only IAM role in your account. You review and control every permission.

Revoke in one click. Delete the stack and all access is removed instantly. No residual permissions.

External ID protection. Cross-account access is secured against confused deputy attacks.

02 Privacy

Metadata only. Never your data.

Configuration metadata. We read security groups, IAM policies, bucket settings, and network topology.

Never your data. No S3 objects, database contents, secret values, application code, or logs.

No credentials stored. Temporary STS tokens are used during the mapping and discarded immediately after.

16 services mapped.

EC2 S3 RDS IAM Lambda VPC CloudTrail GuardDuty KMS ECS WAF SNS CloudWatch Secrets Manager AWS Config CloudFront

03 AI

AI for advisory. Not detection.

58 rules run locally. All security checks, scoring, attack paths, and toxic combination detection run on our backend.

AI generates summaries. Natural language explanations, priority actions, and fix steps are powered by AI models.

Only metadata is shared. Resource types and connection patterns. Never credentials, data contents, or account identifiers.

No training on your data. Your infrastructure metadata is never used to train any AI model.

04 Infrastructure

Encrypted. Ephemeral. Yours.

Encrypted at rest and in transit. All data is protected using industry-standard encryption.

Ephemeral reports. Reports use time-limited access links that expire automatically.

No data sold or shared. Your infrastructure data is never shared with third parties.

Deletion on request. Contact us to have all your data permanently removed.

Your infrastructure.Your control.