ACSETalk to us
  1. Home
  2. Trust
  3. Data boundary

Data boundary

Your data stays yours.

The part of ACSE that reads your cloud runs in your own account. It builds the risk graph there, keeps raw responses there and writes the evidence there. What reaches ACSE’s control plane is the shape of your posture, never the names in it.

Talk to usSee how it works
Your data stays yoursA wall separates the customer’s cloud, holding resource names, ids, configuration and credentials, from what ACSE’s control plane receives: shapes and counts, such as seven buckets of which two are public.7 buckets · 2 publicno names, no idsYOUR CLOUDnames · ids · configcredentials · raw evidenceWHAT ACSE SEES · SHAPES AND COUNTS
01

Less to put in a vendor review

Resource names, ids, configuration and credentials never leave your account, so there is less of your data to assess at a vendor.

02

A boundary you can test

The rule is enforced by message schemas and a deny-by-default registry, not by a policy document.

03

A smaller blast radius if anything goes wrong

A control plane that never holds your names and keys can’t leak them.

What crosses

Open each item to see what ACSE sees

For each kind of data, the left side stays in your cloud. The right side is all the control plane receives.

  • Projections carry shapes and counts. The schema rejects resource names, ARNs and ids, so they cannot be sent by mistake.

Enforced, not promised

How the boundary is held

Each step is a check in code. If any check fails, the message is not sent.

  1. Built in your accountScans, checks, the risk graph and posture summaries all run in the ACSE runtime in your cloud.
  2. Shapes and counts onlyProjections say things like “seven buckets, two public, one on an attack path.” Their schemas have no field that can hold a name, an ARN or an account id, and a value that looks like one is rejected.
  3. Classified before it leavesEvery message type must have an entry in a central egress registry. Anything unregistered, or registered as not permitted to cross, is denied.
  4. Signed on the way outThe runtime opens each connection and signs each request with your tenant’s key, a timestamp and a single-use nonce. Nothing listens in your account.
Two planes, one directionACSE’s control plane holds the portal and approvals. The runtime and the evidence store run in the customer’s account and open every connection outward, signed.CONTROL PLANERUN BY ACSEportal · approvals · reportsRUNTIMEEVIDENCEOUTBOUND ONLY · SIGNEDnothing listens in your accountYOUR ACCOUNTyour cloud, your keys

Evidence and decisions

The record comes home to you

Raw cloud responses, patches and validation results stay in an evidence bucket in your account, under write-once retention. The control plane sees a hash and a verdict.

When a person approves a change in the portal, the signed decision is delivered back to your runtime, checked against your chain and appended to it. Until your runtime confirms it, the decision doesn’t count.

  • Evidence written by your runtime, in your account
  • Decisions delivered back and chained before release
  • Signing keys generated by workflows no person sees
The record lives with youRecords for a finding, the proposed fix, the decision, the merge and the verification are chained, each holding the hash of the one before, and written to append-only storage in the customer’s own account.YOUR ACCOUNTobject lock · append-onlyfindingproposaldecisionmergeverifiedeach record holds the hash of the last

Fail closed

When in doubt, nothing moves

01

Unknown message, denied

A new kind of message can’t cross until it is reviewed and classified. The default is deny.

02

Unknown fact, not a pass

If a check can’t establish a fact, it reports unknown. Unknown never counts as compliant.

03

Missing service, refusal

If a verifier or approval service is unavailable, the action is refused rather than allowed.

Residency

Your data stays in its region

You choose a home region for your settings and evidence. Your runtime and evidence bucket stay in your own account, in the region you deploy them to.

If you use ACSE’s optional AI, the model runs on Amazon Bedrock in your account too, so inference stays inside your boundary.

Your data stays in its regionFour regions, with one chosen as home. Evidence and settings stay in that region.CANADAEUROPEUNITED STATESASIA PACIFICyour home regionevidence and settings stay here

Questions

What people ask us

Does ACSE store my resource names?

Not in posture or risk data. Those projections carry shapes and counts, and their schemas reject names, ARNs and ids. The names stay in your runtime and your evidence bucket.

How can I check what was sent?

Every message type is listed in the egress registry with its classification, and each is signed. Your security team can review the message schemas with us on request.

Does any of my data go to an AI provider?

Only if you turn AI on, and then only to Amazon Bedrock in your own account. The model receives a sanitized context, never secrets or raw cloud responses.

What does ACSE’s control plane hold?

Cases, decisions, posture summaries, settings and notifications, built from the shapes and counts your runtime sends. It is the receiver; it does not read your cloud.

Keep reading

Related

Trust

Read-only and keyless

ACSE connects to AWS, Google Cloud and Azure through short-lived, read-only access you create. No long-lived keys, no admin credentials, no cloud writes.

ReadPlatform

How it works

ACSE’s runtime runs in your cloud and connects outbound only, signed. It reads with no keys and keeps evidence in your account. See the architecture.

ReadSolutions

Data residency

ACSE runs its runtime and evidence store in your own account. Only shapes and counts reach its control plane, and changing region takes two admins.

Read

Talk to us

See ACSE on your cloud.

Tell us what you run and what your auditors ask for. We’ll show you the loop end to end: a real finding, a fix as code, an approval with MFA and the sealed record.

Talk to usExplore the platform