Most of it already works today

Connect AWS read-only and run 93 automated checks — encryption, IAM, logging, network, Lambda, KMS, EKS and more — each mapped to the SOC 2 criteria it covers, with remediation for anything that fails.

59 checks across droplets, managed databases, Cloud Firewalls, Kubernetes clusters, load balancers and backups — the same connect, scan, verify flow as AWS.

42 checks against a private or hosted OpenStack project: security groups, volume encryption, image exposure, Barbican key management, load balancer TLS and backup health.

Scan your GitHub organization across 46 checks: 2FA enforcement, branch protection, required reviews, Actions hardening, secret scanning and other change-management safeguards.

Upload any vendor security questionnaire — PDF, Excel, or Word. ComplyReady answers it directly from your verified cloud and source configuration, with the scan evidence cited.

For questions a scan can't answer, AI drafts a response from your profile and prior answers. Nothing is auto-approved — you review and confirm before anything is used.

Generate security policies tailored to your actual stack — access control, incident response, encryption, and more — fully editable and version-tracked.

A live readiness checklist whose items are verified from your scans, so your status reflects what's actually configured instead of a manual self-assessment.

Publish a clean, public trust page that shows prospects your security posture and policies — without emailing another PDF.

Everything above is free while ComplyReady is in open beta. No credit card, no payment, no trial countdown.

A read-only, in-cluster agent running 39 checks mapped to SOC 2 CC6, CC7, CC8 and CC9. It runs inside your cluster and pushes results out — no kubeconfig or cluster credentials are ever stored. In early access and being tested with our first users.

91 checks are written and running against IAM, Cloud Storage, Compute, Cloud SQL, GKE and org policy. The connect flow is being reworked so nothing is stored until a project verifies, which is what keeps this out of Available.

Closing the verify → fix → re-verify loop: when a scan flags a gap, fix it, re-scan, and have the affected questionnaire answers re-checked against the fresh results — so “verified” always means verified right now.

Scheduled scans, drift detection, and alerts when your posture changes — the direction that keeps you continuously compliant instead of compliant only on the day you checked. This is where we most want to take verification next.

Additional cloud providers and tooling integrations, prioritized by what beta users actually connect and ask for.

Broader check coverage and compliance frameworks beyond SOC 2 over time — shaped by demand rather than a fixed plan.