You run on AWS
Not “we support 14 clouds”. Everything here is built for AWS specifically, which is why the checks understand account-level Block Public Access and scan every enabled region rather than the one you happened to configure.
Start your compliance today. It only counts
if it’s been running BEFORE your auditor asks.
Start on day one — no scramble, no backfilling evidence later.
SOC Binder watches your AWS account and your source control, gathers the evidence an auditor asks for, and keeps the registers, policies and records that no API can produce. Built for solopreneurs, startups before or after funding, and small businesses doing their first SOC 1 or SOC 2 without needing to hire a compliance team.
SOC Binder is in private beta: free for 90 days from your first sign-in, then 50% off your first year at today’s prices. Beta terms
Connect AWS and GitHub in about five minutes — we walk you through both, step by step, right after you sign up. Nothing to install. Read-only by default: nothing in your AWS account or on GitHub changes unless you do it yourself, or turn on Binder Fixes and approve them.
61Trust Services Criteria covered — Security, Availability, Confidentiality, Processing Integrity and Privacy
142control activities, across 16 areas
87automated collectors, run continuously
49editable policy templates
Who it’s for
Your first SOC 1 or SOC 2
Type I or Type II, SOC 1 or SOC 2: pick what your customer actually asked for at signup. A deal is waiting on a report and nobody at the company has done this before. Every control explains what it checks, why an auditor cares, and which results people usually misread.
Nobody’s job is compliance
A handful of engineers and a founder who would rather be shipping. The work that has to be done by a person is named, dated and assigned; the rest happens without anyone remembering to do it.
What it actually does
Collects
37 controls answered by querying AWS and GitHub on a schedule: MFA, encryption, logging, network exposure, branch protection, peer review, dependency and secret scanning. Every run is kept, because a Type II report rests on evidence gathered across a period rather than one good afternoon.
Maintains
The half of an audit no API can answer: risk, vendor and asset registers, a people roster with per-person screening, training and offboarding, an incident log with timelines, and a policy library you edit and approve. Each one has a review date, and the calendar tells you before it lapses.
Proves
Coverage across your observation window, with the gaps named. For a Type II, a gap in collection is itself a finding. Reproducible sampling for the population an auditor tests. A read-only share link so they can look without you emailing screenshots around.
What it won’t do
Most of this category sells a dashboard that goes green. Green is easy to produce and worth nothing at audit, so here is where this one deliberately refuses.
- It won’t call a document a control. Writing an access control policy that says reviews happen quarterly does not prove a review happened. Policies satisfy the controls that ask for a document; the ones that ask for evidence of operation stay open until you have it.
- It won’t pass a check it couldn’t run. A credential that can see nothing looks exactly like a perfectly configured account. Anything unverifiable is flagged for a human, never rounded up.
- It won’t change your infrastructure behind your back. Evidence is always collected through a read-only role. If you turn on Binder Fixes, that is a separate role you deploy and can delete, every change is previewed and approved first, and each one is recorded in a tamper-evident audit trail and in your own AWS logs. A tool that quietly changes what it audits is a tool whose evidence means less; this one does neither quietly.
- It won’t claim full SOC 1 coverage. SOC 1 also tests controls over financial reporting (revenue recognition, billing accuracy) that no AWS API can see. We cover the IT general controls SOC 1 shares with SOC 2; the business-process half stays yours.
- It won’t pretend to be your auditor. Nobody here is a CPA firm and this issues no opinion. It gathers and keeps the evidence; a licensed firm still writes the report.
How the access works
Read-only, unless you opt in
You deploy a CloudFormation template that grants SecurityAudit plus a short, named list of read-only lookups — nothing that can change or delete — with an external ID so nobody else can assume it. Binder Fixes — you approve, we apply — is a second, optional template that can make only the specific fixes it lists, and each one still waits for your approval.
Encrypted, and rotatable
Stored credentials are encrypted with AES-256-GCM under a key that can be rotated without stranding them. Auditors get their own expiring link, not a login, so they can never act on your account.
Your data stays yours
Evidence is scoped to your organization at every query. Export everything as CSV whenever you like. This is your audit file, not ours.
See what your AWS and GitHub would report today
Signing up and connecting AWS and GitHub takes about five minutes, with step-by-step setup as soon as you sign up, and the first collection runs immediately. Most people find something they did not know about in the first pass.
Private beta — request access