Often, yes, at least in some form. Most vendors can reach customer data to troubleshoot, so the useful question is how: which roles, with what approval, for how long, and whether you can see a log of it. Ask for those four answers in writing.
Why support access matters more than most buyers think
Encryption, regions and certifications describe how a platform is built. Support access describes what people can do with it on a Tuesday afternoon when a ticket comes in. A vendor with strong storage controls can still undermine them if any engineer can open any tenant at any time.
For a security platform the stakes are higher than usual. The data includes your unfixed vulnerabilities and your software inventory. That should be treated as a confidential map of your estate.
What a good setup looks like
| Control | What to look for |
|---|---|
| Default access | Support sees metadata and logs, not content, unless granted more |
| Elevation | Access to content needs a ticket, a reason and an approver |
| Time limit | Access expires on its own, within hours or days |
| Customer approval | You can grant and revoke support access to your tenant |
| Logging | Every access is recorded with who, when and why |
| Visibility | You can get that log on request or in the product |
| Staff controls | Background checks, training and confidentiality commitments, per the vendor's policy |
The GDPR processor terms point the same way. Article 28 expects a processor to ensure that persons authorised to process personal data have committed to confidentiality, and to process only on documented instructions from the controller. Support staff are those persons. This is general information, not legal advice.
Questions to ask
- Which roles can open customer tenants, and how many people hold them?
- Is there a way for us to approve each access, or turn support access off?
- Are sessions time limited and logged, and can we see the log?
- Can support see source code excerpts or only metadata?
- When support needs to reproduce a problem, do they copy our data to another system?
- Do contractors or offshore teams have the same access, and under what terms?
- How do you handle a request from a government or other third party for our data?
Question 5 is easy to miss. A ticket system or a debug environment is often where customer data ends up copied and forgotten. Cover it in the retention schedule too, see how long should a platform keep your scan results.
Make it testable
During a trial, open a support ticket that needs access to a test project. Watch the process. Did they ask first? Did you get a record? A vendor that handles this smoothly on a small case probably has the process in place.
How Safeguard fits
If support access to your data must be zero by design, run the platform in your own environment. Safeguard supports private VPC, on-prem and air-gapped deployment. For a first look, use the free scan. Related reading: audit logs and roles questions to ask a security vendor.
Quick check
Is it reasonable to ask for customer approved support access?
Yes. Many enterprise buyers ask for it. A vendor may say no on cost or speed grounds, but the request is fair for sensitive data.
Does a vendor audit report answer this?
It may describe access controls, but read the scope. Ask the specific questions above rather than relying on a report summary.
Sources
Last reviewed: 19 October 2026.
