Support can see: the names and status of your controls, frameworks, issues, risks, assessments, policies and assets; pass/fail results with their times and counts; connector status; and scan findings as titles and counts.

Support cannot see: evidence content or raw connector data, the accounts or objects a check flagged, the names or email addresses of your people, connector settings, credentials or API keys, users, roles, SSO or licence. It cannot change anything or download evidence files and exports. Every request it makes is in the audit log.