Skip to content
Infra Scan Shield

Proof, not promises.

Every report is checked against a published quality checklist before release. Here are the checklists and the practices that protect your accounts.

Read-only by default

Reviews and scans use viewer and security-reviewer roles. We never ask for keys; Google Cloud access is an IAM grant to our scanner identity, AWS is a role that trusts only our identity for your tenant, and Azure is an app registration you control.

Remediation only where you allow it

Automatic remediation is off until you turn it on. It uses a separate identity you grant per account, runs only runbooks you wrote and actions you allowed, is rate-limited, and every call shows up in your cloud’s audit log.

Secrets never leave the scan

The scanner removes credentials, tokens and personal data from results before they are stored or sent to any AI model.

Every report is reviewed before release

A report is drafted from measured data, then a separate review pass checks it against the published checklist. A report that still misses a required item after two attempts is released marked “flagged” with the gaps listed, never silently.

Your data, your choice

Export or delete your account from Settings. Scan data is kept 12 months, audit records 24 months, then deleted automatically.

Built on hardened infrastructure

GKE Autopilot with Workload Identity, private Cloud SQL, encrypted secrets, signed container images, network policies and a web application firewall.

Our quality checklists

Required items must be met for a deliverable to pass. Your portal shows the result for each report, with the checklist version used.

Cloud health check reportFree cloud health check · version 1.010 checks · pass at 85%
  • Every finding names the exact affected resource (project, bucket, rule, account or image), not a resource type.Required
  • Every remediation is specific to that resource, executable as written (console steps, CLI or Terraform) and does not risk an outage without saying so.Required
  • Business impact is stated in plain English from the evidence only; no claim that an attack or breach happened, no invented numbers.Required
  • Severity is consistent with the scanner evidence and CIS Benchmark guidance; nothing is inflated or downplayed.Required
  • The executive summary states the score and names the three most important actions in priority order.Required
  • The score, the severity counts and the findings list agree with each other.Required
  • Security findings carry framework references (CIS control ids) when the scanner provides them.
  • The report contains no credentials, tokens, private keys or personal data beyond business contact names.Required
  • Language suits a non-technical owner; jargon is explained once or avoided.
  • Findings the customer accepted as risks are identified as such with their justification.
Security posture reportContinuous security posture · version 1.07 checks · pass at 85%
  • Every finding names the exact affected resource.Required
  • Every remediation is specific, executable and states any availability risk.Required
  • The report states what changed since the previous scan (new, resolved, reopened findings).Required
  • New critical and high findings are listed first with a recommended response time.Required
  • Business impact uses only the evidence; no invented incidents or numbers.Required
  • No credentials, tokens or personal data appear in the deliverable.Required
  • Findings reference CIS or provider best-practice controls where available.
Cloud cost reviewCloud cost visibility · version 1.07 checks · pass at 85%
  • States the billing data source and period analyzed (billing export, Cost and Usage Report, Cost Management).Required
  • Every recommendation shows the current monthly cost, the expected cost and how the saving was calculated.Required
  • Each recommendation states its performance or availability trade-off and any commitment term.Required
  • Recommendations name the exact resources affected.Required
  • AI and GPU workload spend is reported separately when present.
  • Evaluates commitments (CUDs, Reserved Instances, Savings Plans) against actual steady-state usage.
  • Proposes budgets, alerts and tagging needed to keep savings from regressing.
Monthly reliability reportUptime checks and SLOs · version 1.05 checks · pass at 85%
  • Lists every service's SLO, the measured attainment for the period and the error budget remaining.Required
  • Summarizes incidents and alerts with links to postmortems.Required
  • Reports alert volume and noise (alerts without action) with tuning actions taken.
  • Shows month-over-month trends for latency, errors and saturation of key services.Required
  • Lists reliability improvements for next period with owners.Required
Incident postmortemAutomated incident response · version 1.06 checks · pass at 90%
  • Gives a timestamped timeline from first signal to resolution, with time zones.Required
  • Quantifies customer impact (who, what, how long) from data.Required
  • Identifies root cause and contributing factors with evidence, not speculation.Required
  • Is blameless; focuses on systems and process, not individuals.Required
  • Explains how the incident was detected and how detection could be faster.Required
  • Lists corrective actions with owners, priorities and due dates.Required
Report a vulnerability

Our disclosure policy and safe harbor.

Subprocessors

Who processes data on our behalf, and where.

System status

Live health of the platform.