Secure every machine identity across your clouds
TrustFix detects misconfigured machine identities across AWS, GCP, and Azure — then ships engine-verified Terraform fixes as pull requests on GitHub, GitLab, or Bitbucket. Slack-routed for the engineers who need to know.
Live today on AWS and GitHub. GCP, Azure, GitLab and Bitbucket connectors are built and in preview. 471 detection checks across the non-human-identity surface.
Agentless — live on AWS and GitHub today; GCP, Azure, GitLab and Bitbucket in preview; plus on-prem.
StringLike: "repo:*:*" allowing any GitHub repoMachine identities now outnumber humans 50:1. Most are misconfigured.
CI/CD federation, service principals, workload identity, OAuth tokens, role assumptions across accounts — every team adds them, almost no team audits them. One overly broad trust policy and a fork PR becomes a production incident.
- OIDC trust gaps, over-privileged IAM, custom RBAC drift, exposed Workload Identity Federation — across AWS, GCP, and Azure.
- A wildcard
subclaim or a missingExternalIdturns one CI runner into the whole cloud account. - Most teams find out during the SOC2 audit — or after the post-incident retro.
{
"Condition": {
"StringLike": {
"token.actions.githubusercontent.com:sub": "repo:*:*"
}
}
}- Continuous scan of every machine identity across AWS, GCP, and Azure — 471 detectors covering 24+ finding families.
- Every fix passes 8 validation stages including Formal fix-safety proof — proves access narrowed, never widened.
- Ships as a native PR on GitHub, GitLab, or Bitbucket. Routed to Slack with severity, confidence score, and reviewer hint.
- You review, merge, done. Finding auto-closes. SOC2 evidence packaged automatically.
{
"Condition": {
"StringEquals": {
"token.actions.githubusercontent.com:sub":
"repo:acme-corp/api:ref:refs/heads/main"
}
}
}Three steps. Every cloud. Every code host.
name: TrustFix Scan
on:
schedule:
- cron: '0 0 * * *'
workflow_dispatch:
jobs:
scan:
runs-on: ubuntu-latest
steps:
- uses: trustfix/scan@v1
with:
aws-account-id: ${{ secrets.AWS_ACCOUNT_ID }}# TrustFix Generated Fix
# PR #142 | Confidence: 94/100
- condition {
- test = "StringLike"
- values = ["repo:*:*"]
- }
+ condition {
+ test = "StringEquals"
+ values = ["repo:acme-corp/api:ref:refs/heads/main"]
+ }Every fix validated before it reaches your PR
Not a guess. Not a suggestion. Proprietary, deterministic validation.
Analyzes your existing Terraform and generates fixes that match your codebase patterns and conventions.
Every generated fix is verified for structural correctness and compatibility with your infrastructure.
Proprietary security rules built from production IAM incident experience verify every fix before deployment.
Mathematically proves access was narrowed, never widened. No false sense of security.
A second AI model independently validates the fix, catching edge cases the first missed.
0–100 score in every PR. Below 50 = blocked. Full transparency for your reviewers.
What other platforms don't do
Detection without remediation is a backlog. TrustFix is the only platform that proves the fix and ships it across all three major code hosts.
| Feature | TrustFix | IAM Access Analyzer | Checkov / Trivy | NHI governance tools |
|---|---|---|---|---|
| Cross-cloud detection (AWS · GCP · Azure) | Partial | Partial | ||
| # Detector implementations | 471 | — | ~3 | — |
| Formal fix-safety proof | ||||
| Multi-host PR delivery (GitHub · GitLab · Bitbucket) | ||||
| Fix Confidence™ on every PR | ||||
| SOC 2 evidence export | Partial |
* Based on publicly available feature documentation, April 2026. NHI governance platforms (Astrix/Oasis) focus on identity lifecycle — not IaC remediation.
One platform. Every machine identity.
From detection to formal verification to native pull-request delivery — TrustFix is the end-to-end remediation platform for non-human identity risk across AWS, GCP, Azure, GitHub, GitLab, Bitbucket, and Slack.
471 detector implementations across AWS, GCP, and Azure — IAM trust, custom RBAC, service principals, Workload Identity Federation, AI-agent identities, cross-account trust. 24+ finding families.
Every generated fix is checked to only reduce access — never widen it. A fix that fails the check is flagged as an advisory signal, and can be set to block the PR before it reaches your code host. A proprietary cross-cloud proof engine no other tool ships.
Fixes ship as native pull requests on GitHub, GitLab, or Bitbucket — including self-hosted GitLab. 18 (cloud × host × fix-kind) combinations live, with HMAC-signed PR-merge webhooks closing the feedback loop.
AES-256-GCM envelope encryption with per-tenant data keys and organizationId bound into the encryption context. A breach against stolen ciphertext fails KMS authentication-tag verification.
6-section audit bundle — access logs, credential audit, finding state changes, fix attempts, KMS rotation, encryption evidence. HMAC-signed download URL with 7-day expiry, 365-day default retention.
Per-channel filtering by severity, cloud, host, and finding type. Block Kit composition for finding-created, fix-PR-opened, and Layer-7-falsified events. HMAC-verified, idempotent.
Try TrustFix free — no account required
oidc-audit is the developer on-ramp to TrustFix — the same OIDC trust-policy detection engine that powers the platform, running locally in under two minutes. MIT licensed. Hosted platform extends to GCP, Azure, full PR delivery, formal verification, and SOC2 evidence.
- Same detection engine as the hosted platform — no feature stub
- Runs on your laptop or in CI — credentials never leave your environment
- Ships as a GitHub Action for pull-request gating
Custom enterprise contracts
We're invitation-only while we onboard our first enterprise customers. Tell us about your team and we'll respond within two business days.
Custom enterprise contracts
TrustFix is invitation-only while we onboard our first enterprise customers. Tell us about your team — cloud(s) in scope, security- review timeline, expected user count — and we'll respond within two business days with terms scoped to your environment.
- Multi-cloud (AWS, GCP, Azure) with multi-account caps
- Code-host PR delivery (GitHub, GitLab, Bitbucket)
- SOC2 evidence export + customer audit log
- SAML 2.0 / OIDC SSO
- Formal verification on every fix
- Per-customer entitlements + scoped retention
Every machine identity, every cloud, verified end-to-end.
The Machine Identity Security platform for AWS, GCP, and Azure — with fixes proven to only narrow access, shipped as PRs to your code host of choice.
Currently invitation-only. Try the open-source CLI while you wait.