Privacy policy

Last updated: September 27, 2026. This policy applies to the SaaS "AWS Audit" service published by Silamir Group on AWS Marketplace, as well as to the web portal audit.aws.silamir.com.

1. Data controller

The data controller is Silamir Group, publisher of the "AWS Audit" service. For any question relating to this policy or to the exercise of your rights, you may write to cloud@silamir.com.

2. Data collected

The service processes three categories of data, all necessary to deliver the audit:

2.1 Customer identification data

Provided by you during onboarding on the portal:

• Company name
• Name and email address of the technical contact
• AWS account ID to audit (12 digits)
• AWS regions covered by the audit
• AWS Marketplace customer identifier (customerIdentifier) if the subscription originates from Marketplace
• Cross-account IAM role ARN and External ID that you generate in your own AWS account

2.2 Technical data collected from your AWS account

During audit execution, Silamir assumes - only with the External ID you generated - the IAM role SilamirAuditReadOnly that you deployed. The information collected is strictly configuration and metadata:

• Inventory and configuration of AWS resources (EC2, S3, RDS, Lambda, IAM, VPC, ELB, CloudFront, etc.)
• IAM policies, configuration history (AWS Config), Security Hub, Trusted Advisor, Compute Optimizer recommendations
• Aggregated cost and usage data (Cost Explorer) for the FinOps domain
• Optionally: results of DAST scans (OWASP ZAP, passive or active mode) on the public endpoints you expose (CloudFront, API Gateway, ALB)

2.3 Portal technical data

• 6-digit verification code (expires after 20 minutes)
• Temporary client identifier stored in your browser's localStorage to allow navigation between onboarding steps
• Technical logs (CloudWatch): API calls, durations, return codes, request IDs - no payload content

No audience-measurement or advertising cookie is set. No third-party tracking service (Google Analytics, Meta, etc.) is used.

3. Purposes and legal bases

4. Hosting and data location

The whole service is hosted by Amazon Web Services EMEA SARL, under Silamir Group's responsibility, in the following AWS accounts:

• Production account (929713278836) - region eu-west-3 (Paris, France): portal, API, audit execution, S3 artefact storage, DynamoDB tables, SES email delivery.
• Marketplace seller account (759992627983) - region us-east-1 (Northern Virginia, United States): exclusively for receiving Marketplace subscription notifications and billing reporting. This region is mandated by AWS Marketplace (technical constraint of the aws-marketplace.amazonaws.com service). The only data transiting through this region is the Marketplace customer identifier and the subscribing AWS account ID.

AI analysis is performed via AWS Bedrock with European inference profiles (prefix eu.anthropic.*), ensuring that data sent to the model stays inside the European Union.

Ad-hoc transfers to the United States (Marketplace notifications) are covered by the European Commission's Standard Contractual Clauses embedded in the AWS contract.

5. Retention periods

6. Security measures

• Locked cross-account access: only the Silamir account 929713278836 can assume your IAM role, and only with the unique External ID generated for you. This prevents the confused deputy attack.
• Read-only: the IAM role combines ReadOnlyAccess, Billing and AWSSupportAccess (Trusted Advisor read). No permission allows creating, modifying or deleting your resources; AWSSupportAccess would allow opening a support case, which Silamir never does.
• Short sessions: 1 hour maximum, no persistence of STS temporary credentials.
• Network isolation: collection runs in a private VPC (Fargate), with VPC endpoints for S3, DynamoDB, STS and Bedrock; other AWS API calls are TLS-encrypted.
• Encryption: S3 and DynamoDB encrypted at rest with dedicated AWS KMS keys (yearly rotation); TLS 1.2 minimum in transit.
• No plain-text secrets in code or configuration: systematic use of IAM roles and the GitHub OIDC provider identity for CI/CD.
• Revocable at any time: you can delete the CloudFormation stack SilamirAuditRole in your account to immediately block any future audit.

7. Subprocessors

8. Your rights

In line with the General Data Protection Regulation (GDPR) and the French Data Protection Act, you have the following rights regarding your data:

• Right of access: obtain the list of data we process about you.
• Right of rectification: have inaccurate information corrected.
• Right of erasure: request the deletion of your data (subject to statutory retention obligations). Deletion is performed manually by the Silamir team.
• Right to object and right to restrict processing.
• Right to data portability: receive your data in a structured, machine-readable format.
• Right to define post-mortem directives regarding the retention and communication of your data.

To exercise these rights, write to cloud@silamir.com stating your AWS account ID and your company name. We respond within one month at most.

If you feel, after contacting us, that your rights are not respected, you may file a complaint with the CNIL (French data protection authority): www.cnil.fr.

9. Cookies and local storage

The portal audit.aws.silamir.com uses no cookie and no audience measurement tool. It only relies on your browser's localStorage:

• silamir-lang: the chosen language, to display the portal in your language;
• clientId, externalId (client secret), contactEmail, clientRegions, companyName: resuming the sign-up flow and authenticating your requests to the API.

These uses are strictly necessary for the service you requested: they are exempt from consent (article 82 of the French Data Protection Act), hence no cookie banner. You can clear this data at any time from your browser settings.

10. Policy updates

This policy may evolve. Any material change will be notified by email to the registered contact address. The last-update date is shown at the top of this page.

11. Contact

For any question about this policy or about the processing of your data: cloud@silamir.com.