← Back to Documentation

Privacy & Data Handling

StackSage is designed with privacy as a core principle. Your AWS data never leaves your infrastructure.

Zero External Transmission

All scans run in your GitHub Actions runner. No data is sent to external servers or third parties.

No Credentials Storage

Uses GitHub OIDC for authentication. No long-lived AWS credentials required.

Architecture Overview

StackSage runs entirely within your GitHub Actions environment using a privacy-first architecture:

  1. 1GitHub Actions requests temporary credentials via OIDC
  2. 2AWS STS issues short-lived credentials (1 hour)
  3. 3StackSage scans your AWS resources using read-only IAM permissions
  4. 4Report is generated and saved as GitHub Actions artifact in your repository
  5. 5Credentials expire automatically after workflow completes

What Data is Collected?

StackSage collects only the metadata necessary for cost and security analysis:

Resource Metadata

  • Resource IDs (e.g., i-abc123, vol-xyz789)
  • Resource types and configurations
  • Creation timestamps and region information
  • Tags attached to resources
  • Cost estimates from AWS Pricing API

CloudWatch Metrics

  • CPU utilization percentages
  • Network transfer volumes
  • Storage IOPS and throughput
  • Database connections and query counts

What is NOT Collected

  • ❌ Application data or file contents
  • ❌ Database records or S3 object contents
  • ❌ Environment variables or secrets
  • ❌ Network packet contents
  • ❌ User credentials or access keys
  • ❌ Personal Identifiable Information (PII)

Data Storage

GitHub Actions Artifacts

Reports are stored as GitHub Actions artifacts, which are:

  • Encrypted at rest: GitHub encrypts artifacts with AES-256
  • Access controlled: Only repository collaborators can download
  • Temporary: Artifacts expire after 90 days (configurable)
  • Deletable: You can manually delete artifacts anytime

No External Databases

StackSage does not:

  • Maintain external databases or storage
  • Send telemetry or usage analytics
  • Store logs on external servers
  • Share data with third parties

Docker Image Security

The StackSage Docker image (ghcr.io/amitdubey428/stacksage-audit) is:

  • Reproducible: Built from Dockerfile with version control
  • Scanned: Automated vulnerability scanning
  • Minimal: Based on Python slim image with minimal dependencies
  • Verified: Signed container images for authenticity

Compliance Considerations

SOC 2 / ISO 27001

StackSage's architecture supports compliance requirements:

  • Data locality: All processing occurs in your environment
  • Audit trail: GitHub Actions logs provide complete audit trail
  • Access control: Leverages GitHub's existing access controls
  • Encryption: Reports encrypted at rest by GitHub

GDPR / Data Residency

Since StackSage runs in your GitHub Actions:

  • You control where data is processed (GitHub's data centers)
  • No data transfer to third parties
  • You maintain data controller status
  • Data retention policies are under your control

Network Communication

During execution, StackSage communicates only with:

ServicePurposeData Sent
AWS STSAuthenticationOIDC token (GitHub-issued)
AWS APIResource discoveryAPI requests (describe/list)
CloudWatchMetric queriesResource IDs, time ranges
AWS Pricing APICost estimationRegion, instance types

Sensitive Data Handling

Resource Tags

Tags may contain sensitive information. StackSage includes them in reports for context. If you have sensitive tags:

  • Restrict who can download GitHub Actions artifacts
  • Use tag exclusions to filter sensitive tags from reports
  • Consider using GitHub's private repositories

Cost Information

Cost estimates in reports may be considered confidential. Protect reports by:

  • Limiting repository access to authorized personnel
  • Using GitHub's role-based access controls
  • Enabling branch protection for workflow files

Security Best Practices

  1. Use OIDC: Avoid storing AWS access keys in GitHub Secrets
  2. Read-only IAM: Use least-privilege IAM policies
  3. Private repos: Store workflows in private repositories
  4. Branch protection: Require reviews for workflow changes
  5. Regular audits: Review GitHub Actions logs periodically
  6. Artifact cleanup: Delete old artifacts to reduce data retention

Incident Response

If you suspect a security issue:

  1. Revoke GitHub OIDC provider trust immediately
  2. Delete the IAM role in AWS
  3. Review CloudTrail logs for unauthorized API calls
  4. Report security vulnerabilities to: [email protected]

Questions?

Have privacy or security questions? We're here to help:

Related Topics