You run on AWS
Not “we support 14 clouds”. Everything here is built for AWS specifically, which is why the checks understand account-level Block Public Access and scan every enabled region rather than the one you happened to configure.
Start your compliance today. It only counts
if it’s been running BEFORE your auditor asks.
SOC Binder watches your AWS account and your source control, gathers the evidence an auditor asks for, and keeps the registers, policies and records that no API can produce. Built for startups doing their first SOC 1 or SOC 2 without hiring a compliance team.
Connect a read-only AWS role in about five minutes. No agent to install, and nothing in your account is ever changed.
61Trust Services Criteria covered — Security, Availability, Confidentiality, Processing Integrity and Privacy
120control activities, across 16 areas
19automated collectors, run continuously
46editable policy templates
Who it’s for
Your first SOC 1 or SOC 2
Type I or Type II, SOC 1 or SOC 2: pick what your customer actually asked for at signup. A deal is waiting on a report and nobody at the company has done this before. Every control explains what it checks, why an auditor cares, and which results people usually misread.
Nobody’s job is compliance
A handful of engineers and a founder who would rather be shipping. The work that has to be done by a person is named, dated and assigned; the rest happens without anyone remembering to do it.
What it actually does
Collects
19 controls answered by querying AWS and GitHub on a schedule: MFA, encryption, logging, network exposure, branch protection, peer review, dependency and secret scanning. Every run is kept, because a Type II report rests on evidence gathered across a period rather than one good afternoon.
Maintains
The half of an audit no API can answer: risk, vendor and asset registers, a people roster with per-person screening, training and offboarding, an incident log with timelines, and a policy library you edit and approve. Each one has a review date, and the calendar tells you before it lapses.
Proves
Coverage across your observation window, with the gaps named. For a Type II, a gap in collection is itself a finding. Reproducible sampling for the population an auditor tests. A read-only share link so they can look without you emailing screenshots around.
What it won’t do
Most of this category sells a dashboard that goes green. Green is easy to produce and worth nothing at audit, so here is where this one deliberately refuses.
- It won’t call a document a control. Writing an access control policy that says reviews happen quarterly does not prove a review happened. Policies satisfy the controls that ask for a document; the ones that ask for evidence of operation stay open until you have it.
- It won’t pass a check it couldn’t run. A credential that can see nothing looks exactly like a perfectly configured account. Anything unverifiable is flagged for a human, never rounded up.
- It won’t change your infrastructure. The role you grant is read-only, and remediation is a command handed to you to run, not something executed on your behalf. A tool that can change what it audits is a tool whose evidence means less.
- It won’t claim full SOC 1 coverage. SOC 1 also tests controls over financial reporting (revenue recognition, billing accuracy) that no AWS API can see. We cover the IT general controls SOC 1 shares with SOC 2; the business-process half stays yours.
- It won’t pretend to be your auditor. Nobody here is a CPA firm and this issues no opinion. It gathers and keeps the evidence; a licensed firm still writes the report.
How the access works
Read-only, by construction
You deploy a CloudFormation template that grants SecurityAudit and nothing more, with an external ID so nobody else can assume it. There is no write permission to misuse because none is requested.
Encrypted, and rotatable
Stored credentials are encrypted with AES-256-GCM under a key that can be rotated without stranding them. Auditors get their own expiring link, not a login, so they can never act on your account.
Your data stays yours
Evidence is scoped to your organization at every query. Export everything as CSV whenever you like. This is your audit file, not ours.
See what your AWS account would report today
Signing up and connecting an account takes about five minutes, and the first collection runs immediately. Most people find something they did not know about in the first pass.
Get started