Security

What Acciew can see, and what it can never do.

Plain answers for the person who signs off on a new tool. The exact permissions are on the technical details page.

What Acciew can see

Who has an account in Keycloak, GitHub and AWS, which groups, teams and roles they are in, and, where the system records it, their last sign-in.

KeycloakAccounts, groups, roles, last sign-inRead-only
GitHubMembers, teams, repository access, installed appsRead-only
AWSUsers, groups, roles, policiesRead-only

It only reads

Acciew never creates, changes or removes access. Managers decide; your admins make the change in the system itself.

Reads who has what
Records each manager’s decision
Does not create accounts
Does not change or remove access

Where login details live

The login details for your systems can sit in Acciew’s hosted service, or stay inside your network. You can revoke them in your own system at any time.

In Acciew’s serviceThe quickest start. The details are encrypted before they are stored.
Inside your networkThe details never leave your side.

Hosted, or on your own servers

We host Acciew for you. If your policy asks for it, you can run all of Acciew on your own servers, on request.

Hosted by usNothing to run. Open the link, start the review.
On your serversThe whole product inside your walls, on request.

How the evidence is kept

Everything collected and every decision goes into the full record. A decision is never overwritten: a change is added as a new entry, with who made it and when.

Collected · Keycloak, 214 accounts1 Oct, 08:02
Decided · Dana’s billing admin, approved by Priya9 Oct, 10:12
Changed · same access, now rejected by Priya, with a note10 Oct, 09:40
Finalized · confirmed by Priya and Marcus31 Oct, 17:05

Sample data. Both entries for Dana’s access stay in the record.

Your engineer will want the exact permissions and where the code lives.

Technical details for your engineer