Cloud security and
risk operations.
Unified.
CloudSignals+RiskOps™ is AiVRIC's AI-native CSPM and GRC platform — continuous multi-cloud posture management, an always-current risk register, automated compliance evidence, third-party risk, and GenAI-powered risk narratives in one product.
What's in every plan
- Multi-cloud inventory (AWS, Azure, GCP)
- 500+ CSPM checks out of the box
- Risk register with scoring & ownership
- Compliance framework mapping
- GenAI risk narrative & chat
- Audit-ready evidence export
- Jira & webhook integrations
- Role-based access control
Use cases
Four modules. One unified product.
Every CloudSignals subscription includes all four modules — no add-on fees, no separate licenses.
CloudSignals CSPM
Continuous multi-cloud posture management across AWS, Azure, and GCP with 500+ automated checks and real-time drift detection.
- Unified cloud asset inventory
- Misconfiguration detection & scoring
- Policy-as-code guardrails
- Agentless deployment in <15 min
RiskOps™ Register
A living risk register that auto-populates from scan findings, assigns ownership, tracks treatment decisions, and quantifies exposure.
- Auto-generated risk records
- Risk quantification (financial impact)
- Treatment workflow & approvals
- Executive risk reporting
TPRM Discovery
Automate third-party risk assessments with vendor discovery, elevated review workflows, and managed entity linkage to your risk posture.
- Vendor & supplier discovery
- Elevated vendor review queue
- Managed entity risk linkage
- 250 TPRM records (Premium)
Vision AI Optics
GenAI-powered risk narratives, intelligent compliance summaries, and a natural language chat interface across your entire security posture.
- GenAI risk narratives per finding
- NL compliance summaries
- Tenant-context AI chat
- 1,500 vision prompts/mo (Premium)
Built for enterprise security and compliance teams
Every capability maps to a real procurement requirement — from CISO dashboards to audit evidence packages.
Unified Cloud Inventory
Normalize assets, configurations, and metadata across AWS, Azure, and GCP into a single queryable inventory with relationships intact.
Control Framework Mapping
Automatically map findings to 14+ compliance frameworks — SOC 2, ISO 27001, PCI-DSS, CMMC, HIPAA, NIST CSF, and more.
Risk Prioritization Engine
Context-aware scoring combines severity, exploitability, asset criticality, and business impact to surface what matters most.
Automated Evidence Collection
Continuously gather and package audit evidence — control screenshots, configuration snapshots, and remediation records — exportable on demand.
Release Governance
Track change windows, approval gates, and deployment risk so audit findings never surprise your change advisory board.
Jira & SIEM Integration
Native Jira bi-directional sync, webhook connectors, and SIEM forwarding keep your existing workflows intact while enriching them with risk context.
RBAC & Multi-Tenancy
Granular role-based access, SSO/SCIM provisioning, and multi-tenant isolation for MSPs and large enterprise organizations.
Executive & Audit Reporting
Board-ready posture summaries, trend charts, and auditor-facing compliance reports generated automatically on a configurable schedule.
Premium plan — what's included
Compare all plansPremium is $499/month. Need more? Enterprise plans offer custom limits, dedicated CSM, and white-glove onboarding. All plans include a permanent free tier.
14+ frameworks. Mapped controls. Audit-ready evidence.
CloudSignals ships with pre-built control mappings so your team goes from scan to audit evidence without manual cross-referencing.
SOC 2 (Type I & II)
Security, Availability, Confidentiality, Processing Integrity, Privacy
- Centralizes control evidence and configuration logs for Type II periods
- Tracks remediation activity with approval workflows and timestamps
- Generates executive-ready Trust Services Criteria reporting
- Supports CC6, CC7, and A1 Trust Services criteria out of the box
ISO/IEC 27001:2022
Information Security Management System (ISMS)
- Maps findings to Annex A control objectives and risk register entries
- Documents remediation and verification workflows for ISMS evidence
- Supports Statement of Applicability (SoA) generation
- Aligns to 2022 revision control set (93 controls, 11 new)
PCI-DSS v4.0
Payment Card Industry Data Security Standard
- Flags CDE scope misconfigurations and policy violations in real time
- Produces SAQ and QSA-ready reports with evidence attachments
- Tracks remediation with accountability chains for Requirement 12
- Supports v4.0 customized approach evidence requirements
CMMC 2.0
Cybersecurity Maturity Model Certification — Federal Contractor Readiness
- Aligns controls to Level 1 (17), Level 2 (110), and Level 3 requirements
- Maintains POA&Ms and exception documentation for C3PAO assessors
- Supports System Security Plan (SSP) evidence collection
- Tracks CUI boundary compliance and access control findings
HIPAA Security Rule
Health Insurance Portability and Accountability Act
- Maps cloud misconfigurations to ePHI safeguard violations
- Supports annual risk analysis documentation requirements
- Tracks BAA-relevant third-party risk in TPRM module
- Provides breach notification risk scoring for covered entities
NIST CSF 2.0 & 800-53
Plus: CIS Benchmarks, FedRAMP, GDPR, DORA
- Full NIST CSF 2.0 function and subcategory mapping
- CIS Benchmark checks for AWS, Azure, GCP (L1 and L2)
- FedRAMP Low/Moderate control evidence support
- GDPR technical controls and data residency monitoring
Deploy the way your security policy requires
CloudSignals adapts to your data residency, network, and sovereignty requirements — not the other way around.
AiVRIC SaaS
Managed, fully hosted by AiVRIC. Connect cloud accounts via read-only IAM roles. No agents. No infrastructure to maintain. Operational in <15 minutes.
Customer-hosted SaaS
Deploy into your own AWS, Azure, or GCP environment. AiVRIC manages the application layer; you own the infrastructure and data plane entirely.
Air-gapped / Private
Fully disconnected deployment for high-security or regulated environments. Packaged container images delivered via secure transfer with offline update support.
Start free. Scale as you grow.
Every plan includes all four modules. No feature gating per module. Paid plans start at $499/month for up to 75 cloud accounts.
Answers for security, compliance, and procurement teams
What deployment models are supported?
AiVRIC SaaS (fully managed), customer-hosted SaaS (your cloud, AiVRIC-managed app layer), and air-gapped private deployment. All models share the same feature set. Review our Trust Center for infrastructure details.
Where does my cloud data reside?
AiVRIC SaaS is hosted on AWS with regional data residency options (US, EU). Customer-hosted SaaS keeps all data in your own cloud account. Air-gapped deployments are fully offline. See our data handling policy.
What IAM permissions are needed?
CloudSignals uses read-only IAM roles — no write access to your cloud accounts required. We provide Terraform modules and CloudFormation templates for role provisioning. Least-privilege role definitions are published in our documentation.
How does SSO and user provisioning work?
CloudSignals supports SAML 2.0 and OIDC SSO (Okta, Azure AD, Google Workspace, and any standards-compliant IdP). SCIM 2.0 provisioning is supported for automated user lifecycle management. Granular RBAC with custom roles available on Premium and above.
What integrations are available?
Native Jira bi-directional sync (create issues, update status from findings), Slack and Teams notifications, webhook connectors for SIEM/SOAR (Splunk, Sentinel, QRadar), and a REST API for custom integrations. CI/CD pipeline scanning available via GitHub Actions and Azure Pipelines plugins.
How is pricing calculated?
Pricing is based on cloud accounts, not scanned resources. This means your cost is predictable regardless of asset growth within an account. The Free tier supports 3 cloud accounts permanently. See the full pricing page for tier details.
Is there an audit evidence export?
Yes — every plan includes automated evidence packaging. Export control evidence, configuration snapshots, and remediation records as PDF, CSV, or JSON. Enterprise plans support scheduled automated evidence delivery to auditor portals.
What SLAs and support options are available?
Free and Growth Trial plans receive community support. Premium includes business-hours email/chat SLA (next business day). Enterprise and White-label plans include dedicated CSM, 4-hour critical SLA, and named escalation paths. Talk to sales for enterprise SLA details.
Ready to secure your cloud?
Start free in minutes — no credit card required. Connect your first cloud account and see your posture score before lunch.