What Quiverstone does with a client account
Temporary STS credentials only. Your browser session, their CloudTrail. We never store long-term client credentials.
Role deployment
Deploy a Quiverstone-managed role through CloudFormation or StackSets, or reuse an existing IAM role that already has the required trust. Access is direct or chained role assumption with an External ID.
External ID is how AWS checks the assume-role request came from Quiverstone.
You choose the permission level on that role: Read-Only, Power User, Administrator, or a custom policy. Team access is scoped by Group × Account × Role. The role’s policies decide what the session can do.
What gets stored
Quiverstone does not store long-lived access keys for client accounts. A session uses your browser to assume the role on demand. That access event is written to CloudTrail in the destination account, so the client’s own log shows who assumed what and when.
Quiverstone is hosted on AWS us-east-2. It does not offer a separate region for data residency.
Certifications
Quiverstone is an early-stage product. SOC 2 Type II and ISO 27001 audits are planned to begin in Q1 2027. They are not complete. If a certification is a hard requirement today, contact us before you enroll a client Org.
The founder, Ross Wickman, has 10+ years of AWS management work, including DOD/DOI environments and GovCloud/FedRAMP.
Docs: https://docs.quiverstone.io/setup/accounts/access · https://docs.quiverstone.io/setup/roles