Beamreach
Security
What Compass sends out of your environment
Compass runs in your environment: a VM, a server, a laptop or your AWS account. Beamreach has no access to it. There is no shared account, no tunnel and no remote support channel in the product, and I never ask for your cloud credentials, your GitHub credentials or a login to your install.
A running install still makes network calls, because its job is to read your cloud and open pull requests. This page lists every one of them, what it carries, and how to turn it off.
Calls to services you already use
These go to your own accounts with the credentials you gave Compass. Beamreach is not on the path.
| Destination | Why | What is sent |
|---|---|---|
| AWS APIs, in the accounts you connect | Reading inventory, the audits, cost data; the actions you approve | Signed API calls with the read role you created, and the act role only for approved actions |
| Amazon Bedrock, in your AWS account | The language model | The prompt for the task at hand: the finding, the relevant Terraform or code, metadata of the resources involved |
| GitHub | Reading repositories, opening and revising pull requests | Git operations and API calls as your own GitHub App or token |
| Slack, Jira, your SMTP or SES | Notifications, when you configure them | The notification text, to the destination you set |
Calls to public data sources
Anonymous reads of public data. Nothing about your environment is in the request.
| Destination | Why | Turn off |
|---|---|---|
| OSV, CISA KEV, FIRST EPSS, the Ubuntu, Debian, Alpine and Amazon Linux trackers, Packagist, npm | The patch captain's vulnerability feeds and fixed versions | Turn the Patches captain off, or set COMPASS_CVE_FEED=0 |
| raw.githubusercontent.com/beamreach-ai/compass | The release feed and the captain catalogue. The request carries the running version and nothing else | COMPASS_UPDATE_CHECK=off |
| beamreach.ai | Release notes, when a release is out | COMPASS_RELEASE_NOTES_URL=off |
Calls to Beamreach
Only in the Enterprise edition, all to api.beamreach.ai. The open-source edition makes none of them.
| When | What is sent | Default |
|---|---|---|
| Once a day, for a paid subscription | The Stripe customer id. The answer says whether the subscription is active and how many accounts it covers | On |
| Once, on a fresh install without a licence, after AWS is connected | The AWS account id, to find a subscription bought for that account before a reinstall | On |
| When an alert is emailed and you have set up no sender of your own | The recipients, the subject and the body of the alert. It is relayed and not stored | On |
| When a person presses Subscribe or Manage subscription | The address of your dashboard, for the return link, and the AWS account id | On |
| Once per install: a note that the install exists | The admin's email, an install id, the AWS account id, the region | Off |
A trial licence, and any licence with an end date, is verified on your machine with a public key that ships in the image. It needs no call at all.
Turning them off
COMPASS_OUTBOUND=offWith that in the environment, Compass makes no call to Beamreach. Two consequences:
- The install needs a licence with an end date. A trial is one. For a paid licence, ask for an annual key against an invoice.
- Alert emails need your own sender, SES or SMTP in Settings, or Slack.
What never leaves
- AWS credentials, role ARNs and external ids. They are in the workspace config, on your disk or in your Secrets Manager.
- GitHub tokens and App private keys.
- Your code and Terraform, beyond the excerpts sent to the model in your own AWS account.
- Findings, the map, job history and pull request contents.
- Usage counts. There is no telemetry or analytics in the product.
Check it yourself
Every destination above is a plain HTTPS call from the containers. Run the stack behind an egress proxy or a firewall with an allow list, and compare. The open-source core is public, so the calls it makes can be read in the code.
Who is behind it: Ilia Dubovskii, solo founder of Beamreach. I work on DevOps, security and IT operations and nothing else. Questions about any line on this page go to sales@beamreach.ai or a 30-minute call.