Detect across 5 platforms
474 detector implementations spanning AWS, GCP, Azure, GitLab, and Bitbucket — across IAM trust policies, RBAC bindings, custom roles, CI/CD pipelines, and Workload Identity Federation.
Check every fix before it ships
Every fix is checked to only narrow access before a pull request opens: a deterministic check blocks any fix that would widen access, and a formal narrowing check is attached (advisory by default).
Ship as pull requests
Native pull requests: GitHub tested (live); GitLab and Bitbucket built, to be tested. Fixes are generated for your cloud, code host, and fix type, from a library of pre-validated templates first.
Encrypt every credential
AES-256-GCM with per-tenant data-encryption keys. organizationId is bound into the encryption context so a database breach cannot decrypt cross-tenant ciphertext.
SOC 2 evidence collection built-in
6-section SOC2 evidence export with HMAC-signed download URL. SAML 2.0 + OIDC SSO. Per-customer entitlements. Customer audit log with configurable retention.
Govern AI agents & NHIs
Born-verified agent passports, delegation provenance, and a trust score for every service account, role, and AI agent — issued and revocable from one signed ledger.