Start free
Free AWS security scan
TrustProof's free AWS scan connects through a read-only role and shows your findings ranked by risk, mapped to the frameworks you care about. Your first scan takes minutes to set up and needs no card.
Key facts
What you can check
- Free, once per workspace
- One free read-only AWS scan per verified workspace. It is read-only, and its AWS checks map to four selected SOC 2 criteria (CC6.1, CC6.6, CC6.7 and CC7.2). Create a workspace to begin; no card is required.
- Read-only AWS role
- TrustProof connects through a read-only IAM role you create from our CloudFormation template and can remove at any time. No passwords, no stored keys.
- What TrustProof checks
- Examples include public S3 access and bucket encryption, MFA for IAM users and the root user, root access keys, access key rotation, password policy, security groups open to SSH or RDP, CloudTrail, GuardDuty, and EBS and RDS encryption.
- Mapped to frameworks
- Selected AWS checks are mapped to 13 HIPAA Security Rule references, eight ISO/IEC 27001:2022 Annex A controls, and limited SOC 2 traceability for CC6.1, CC6.6, CC6.7 and CC7.2.
- Hosted in AWS Sydney
- TrustProof runs on AWS in the Sydney region (ap-southeast-2), encrypted at rest and in transit.
What TrustProof does
- Connects through a read-only role you can remove at any time
- Ranks findings by risk and shows the next step for each
- Maps findings to the frameworks you work towards
What TrustProof doesn't do
- The free scan shows findings only; applying fixes needs One-Button Fix or a plan.
- It does not change anything in your AWS account.
- It does not certify, and a clean scan is not an audit result.
FAQ
Frequently asked questions
Is the scan really free?
Yes. You get one free initial scan per verified workspace, and no card is required.
What access does TrustProof need?
A read-only IAM role, created from our CloudFormation template in your account. You can remove it at any time. No passwords or stored access keys.
What does the free scan cover?
It is read-only, and its AWS checks map to four selected SOC 2 criteria (CC6.1, CC6.6, CC6.7 and CC7.2).
Can the scan change my AWS account?
No. The scan uses a read-only role and cannot make changes.
What happens after the scan?
You can fix findings yourself, buy One-Button Fix (A$1,499 one-off) to have fixes prepared for your approval, or choose a plan with monitoring from A$899 a month.