S3 buckets, Azure Blob containers, GCS buckets. Classified and monitored.
PostQKey discovers every object store in your cloud accounts, samples the data, classifies sensitivity, and flags public-read access, unencrypted stores, and overshared buckets.
Common cloud storage risks PostQKey catches.
Customer data accessible without authentication
An engineer needed to share one file with a partner and set the bucket to public-read. The file was removed. The ACL was never revoked. 18 months later, 2.4 million customer records are internet-accessible. PostQKey catches this in the first scan.
Default settings in some Azure and GCP regions
Azure Blob containers and GCS buckets created without an explicit encryption policy in certain regions default to no server-side encryption. PostQKey flags unencrypted stores that contain classified sensitive data.
Bucket policies that allow *.amazonaws.com without conditions
A bucket policy that grants s3:GetObject to Principal: "*" with a condition on aws:PrincipalOrgID sounds restricted. But if the condition is on the wrong IAM condition key, or uses a service principal without a condition at all, any AWS account can read the bucket. PostQKey evaluates the effective permission, not just the presence of a condition clause, and surfaces these ambiguous policies for review.
How PostQKey scans cloud object stores.
Connection and permissions
PostQKey requires List and Get permissions via IAM role (AWS), service account (GCP), or managed identity (Azure). No write access. No delete access. You can scope the role to specific buckets or projects.
Sampling logic
PostQKey samples up to 500 objects per bucket, selecting by extension: CSV, JSON, Parquet, PDF, XLSX. Sampling is weighted toward recently modified objects and objects in paths that match common data-export naming conventions.
Classification
Classification runs in PostQKey's secure compute layer on the sampled data. No objects are retained. Findings are returned as a structured report: bucket ARN or resource path, classification type (PII/PHI/financial/confidential), confidence score, and the sample path that triggered the finding. PostQKey does not store the actual file content, only the finding metadata.
Connect your first S3 bucket in 10 minutes.
Read-only IAM role. PostQKey scans, classifies, and returns a finding report.