Trust & Security

Last updated: September 23, 2026

Pathbreak maps how an attacker could escalate privileges inside your cloud. That makes the way we handle your access and your data as important as the product itself. This page explains how Pathbreak is built to be trusted with it. We keep this page current as the product and our assurances grow.

Least-privilege, read-only access

Pathbreak connects to your cloud with least-privilege, read-only access that you grant and control. You scope it to the accounts you choose, and you can revoke it at any time. We ask for no more than we need to map and validate attack paths.

What Pathbreak reads

Pathbreak reads identity and policy metadata, such as IAM policies, roles, trust relationships and resource configuration, to map how privileges could be escalated. Resource configuration includes the places where credentials are commonly exposed, such as instance user-data, function environment variables and stack outputs, because finding exposed keys is part of the job. It does not read your object storage or database contents. Detected secrets are reported by type and location, and the values are not kept. When a scan finds an exposed AWS access key, Pathbreak keeps the key ID (the public AKIA identifier) so it can name the key in the remediation. It never reads or stores the secret access key.

The agent is read-only

Pathbreak validates an attack path by resolving the real authorization end to end. It does not exploit the path. The agent is read-only: it confirms whether a chain is exploitable, and nothing is executed against your resources. When it finds a path, it hands you the exact change that severs it, so you decide what to apply.

Isolation and encryption

Your data is kept isolated and encrypted in transit and at rest. Access to it inside Pathbreak is limited to what is needed to operate the service.

Your findings are yours alone

The exposures and attack paths Pathbreak finds in your environment are visible only to your own team, isolated from every other customer, and never used for anything else. We do not use them to train models, we do not share them, and they never feed into any other product. We retain them only as long as needed to provide the service and under the terms of your agreement, and you can ask us to delete them.

Runs on the model you choose

Pathbreak's agent is powered by a large language model, and you decide which one and where it runs. Point it at Anthropic, OpenAI, Google Gemini, Amazon Bedrock inside your own AWS account, or any OpenAI-compatible endpoint you host yourself. Your provider credentials are stored encrypted. If you run the model in your own account or on your own endpoint, model traffic stays inside infrastructure you control; the graph and findings live in your isolated Pathbreak tenant. The verdict on a path never depends on the model: paths are resolved deterministically against your real authorization, and the model handles language, exploration and explanation.

Single sign-on and least-privilege roles

There is no open self-serve signup for Pathbreak. You prove ownership of your company domains through DNS, bring your own identity provider with single sign-on (OpenID Connect today, SAML on request), and require it so password sign-in stops for your people. Assign role-based permissions, with custom roles if you need them, so each teammate sees only the accounts and actions they should. It is the same least-privilege posture we apply to your cloud, applied to the product itself.

Support access you can see

If our staff ever need to enter your organization to help with a problem, the visit is time-boxed, read-only unless stated otherwise, needs a written reason, and is listed on a page in your tenant. Every session is listed there.

Who we do business with

Pathbreak maps how an attacker could move through a cloud, so we hold our customers to a higher bar than ordinary software. We sell only to verified organizations, not to individuals, and every customer is screened against international sanctions and denied-party lists, including the UN Consolidated List, the UK OFSI consolidated list, the EU Consolidated List, and the US OFAC Specially Designated Nationals and BIS Entity Lists. We do not provide the service to comprehensively embargoed jurisdictions, and higher-risk relationships receive enhanced diligence, including beneficial-ownership review. We re-screen active customers when they renew and when sanctions lists change. We treat our technology as potentially export-controlled and apply diligence accordingly.

Compliance and certifications

ISO 27001 and SOC 2 are both in progress. Our information security management system is already operating ahead of certification, and we can walk your security team through our controls and share supporting documentation under NDA as part of procurement. This page and our assurances grow as the product matures.

Built for enterprise procurement

Access to Pathbreak requires a verified company domain, with single sign-on and role-based permissions as described above. We make a Data Processing Agreement available on request, and we respond to vendor security questionnaires as part of enterprise onboarding. For anything your review needs that is not covered here, ask us.

Subprocessors

We use a small number of third-party providers to run the service, including HubSpot for our website, CRM, and customer communications, and our cloud hosting provider for the platform itself. The large language model that powers the agent runs on the provider you choose, under your own credentials, as described above. A complete, current subprocessor list is available on request.

We hold our own platform to the same standard

We harden our own infrastructure and welcome reports from security researchers. See our Security Policy and machine-readable security.txt for how to reach us and what is in scope.

Data protection and privacy

How we handle personal data is set out in our Privacy Policy, and the terms of using Pathbreak are in our Terms of Service. Pathbreak Ltd is registered in England and Wales, company number 17265710.

Questions

For anything about security or trust, contact security@pathbreak.io. For everything else, hello@pathbreak.io.