What Caspian reads, and with which rights

Updated 4 November 2026.

Caspian connects to the systems a company runs on: the identity provider, the HR system, SaaS apps and laptops. This page says what it reads there, what it never reads, how changes get approved, and how it was tested. Controls, policies and subprocessors are in the trust center.

What Caspian reads

Metadata and settings. Caspian reads which apps exist, who has an account in each, which role that account has, which groups and shared resources a person belongs to, and the state of each laptop: apps and versions installed, FileVault, firewall, Gatekeeper, screen lock, OS version and last check-in. That is what it needs to give, change and remove access, and to show what is out of policy.

What Caspian never reads

File contents, email bodies and chat messages. Caspian sees that a shared drive or a Slack channel exists and who is in it, not what is inside it.

Which rights it asks for

Connections are read-only by default. Caspian asks for write rights per app, and only for the steps you switch on, such as removing a leaver's account. Seeing everything is free and stays read-only.

The approval log

A person approves every removal before Caspian makes it. Caspian logs each request, decision and change: who asked, for what, why, who approved, when, and the result of the read-back check, where Caspian reads the app again to confirm the change happened. That log is the evidence an auditor asks for.

Where data lives

Customer data is stored with AWS in the EU (Frankfurt). Caspian BV is a Belgian company in Ghent; the DPA sets out the processing terms.

Testing

An external penetration test was carried out by Workstreet in August 2026.

Questions

Write to support@getcaspian.io, or request documents in the trust center.