The third party with standing keys to your database

You trust your integration partners, and the access they hold was granted for good reasons by people who knew what they were doing. Fair enough. The question is not whether they are trustworthy. It is who outside your walls can reach into your production database right now, and whether anyone has checked that list this year.

A vendor connects to do an install. A contractor gets a login to debug something urgent. An integration partner needs a service account to move data overnight. Each grant was reasonable on the day. None of them came with an end date. Years later the work is long finished and the access is still live, often broader than what your own staff hold.

Here is the part that should keep you up. Their security is now your security. If that partner gets phished, if a laptop with saved credentials walks out a door, if a third party they use gets breached, the path runs straight into your data. You did not pick their staff. You do not see their controls. And their bad day quietly becomes your breach, your notification obligation, your board meeting.

Can you say no to this question with a straight face: is there a current, written list of every external party with access to production, what each one can do, and the last date someone confirmed they still need it? If that list does not exist, the honest answer is that you do not know who can touch your data. The connections have been there the whole time, scattered across systems nobody owns.

So how would you find out, without taking anyone’s word for it? Not by asking the vendors what access they have. By looking at the database itself and reading back every login, every service account, every standing connection from outside, then asking of each one: should they still be able to do this?

We run a free, read-only 15-minute health check that surfaces exactly that. Who can reach your production data, what they can do, and which of those keys nobody remembers cutting. You get a graded, plain-English report. No install, no change to your systems, just a clear answer to a question most boards have never actually asked.