Upload the output of an open-source security scan. Get provenance-stamped, multi-framework compliance evidence in minutes — without ever giving us access to your cloud.
No agents. No IAM roles. No API keys. We never hold your credentials.
Open-source scanners are free and everywhere — but they hand you hundreds of pass/fail rows of technical noise. Translating that into ISO 27001 and SOC 2 evidence is manual spreadsheet labor. The heavyweight GRC suites that automate it cost $15k–$100k a year and want agents in your environment. Viwago sits in between: the translation, without the custody.
Use the open-source scanner you already trust (Powerpipe today). It runs on your machine, with your credentials.
Drop the JSON result into Viwago. We only see the scan output — never your infrastructure or keys.
In minutes: a provenance-stamped, multi-framework posture and auditor-ready exports. No spreadsheets.
Everything below is in the product now. We don’t list what we haven’t built.
You run your own scan with your own tools and credentials. Viwago only ever reads the output file. No agents, no IAM roles, no API keys — we never touch your cloud.
One CIS scan, mapped to ISO 27001 and SOC 2 today, with more frameworks expanding. Stop re-doing the same control mapping by hand for every standard.
Every score states where it came from (“based on your uploaded Powerpipe scan”). Export to OSCAL, the NIST machine-readable format auditors expect.
Cover the controls a scanner can’t check — physical access, offboarding, policies — with evidence, and watch coverage climb toward complete.
Hand your auditor a real artifact: PDF for the board, CSV for your workflow, OSCAL for their tooling, JSON for your pipeline.
We never deploy an agent, assume an IAM role, or hold an API key — so there’s no cloud access for a vendor review to scrutinize. The scan results you upload are encrypted in transit and at rest, and strictly tenant-isolated: access is derived only from a verified identity token, fail-closed by design.
SOC 2 in progress. We publish what is true and nothing that isn’t.
Framework coverage expands as our control mapping grows.