Map every identity that can reach sensitive data.
PostQKey builds a queryable access graph from IAM policies, database roles, and SaaS permissions. Find overprivileged paths before an attacker does.
Where PostQKey reads access from.
- AWS IAM: users, roles, policies, and cross-account trusts
- Snowflake RBAC: roles, grants, stored procedures, future grants
- Google Workspace: Drive sharing, group memberships, admin delegations
- Salesforce: profiles, permission sets, sharing rules, public groups
- PostgreSQL and MySQL: role grants and table-level privileges
- BigQuery IAM bindings and dataset-level access controls
Identities, permissions, data assets. The complete picture.
The number of edges is always much larger than the number of identities. That is the point: a role granted VIEW on a Snowflake schema automatically inherits access to new tables added to that schema 18 months later. Nobody reviewed those grants because nobody added them explicitly. PostQKey traverses the full role hierarchy and computes effective access per identity, showing you what each principal can actually query, not just what was explicitly granted to them.
Example numbers from a typical mid-size deployment. Your graph may be larger or smaller.
Access risk PostQKey surfaces.
Access to sensitive data, unused for 90 days
An analyst who was granted SELECT on a customer PII table for a one-time project still has that access 14 months later. PostQKey correlates access grants against query logs to surface unused paths.
Service accounts for integrations that no longer exist
The ETL pipeline to the defunct BI vendor was decommissioned. The service account was not. It still has READ on your payment tables. PostQKey flags service principals with no recent activity.
Access to both production PII and public-facing infrastructure
An identity with access to both your customer PII store and a public S3 bucket creates a potential data exfiltration path. Not every combination is a violation, but every combination is worth knowing. PostQKey surfaces these cross-perimeter access patterns explicitly, with the full permission chain from identity to asset.
See your access graph in 24 hours.
Connect your first IAM source or data store. PostQKey builds the graph automatically.