Dashboard
Loading Infraproof...
IaC-verifiable requirements
Policy documentation
Upload docs or scan IaC
Connect your CI/CD pipeline
Scan every PR automatically. Get compliance checks on every commit.
Upload and manage your compliance documentation
Drag and drop files here, or
Supports PDF, DOCX, TF, YAML, JSON (max 50MB)| Name | Type | Analysis | Status | Uploaded | Actions |
|---|---|---|---|---|---|
|
Loading documents... |
|||||
Run and review compliance assessments across 20 frameworks
Run your first compliance assessment across SOC 2, HIPAA, PCI-DSS, NIST, CMMC, or any of 20 frameworks.
Scan and verify your infrastructure-as-code for compliance
Upload your Terraform or CloudFormation files to scan for compliance issues.
Upload compliance documents and infrastructure-as-code for analysis
Drag and drop files here, or
Supports PDF, DOCX, TF, YAML, JSON (max 50MB)| Name | Type | Compliance Status | Status | Uploaded | Actions |
|---|---|---|---|---|---|
|
Loading evidence... |
|||||
View compliance status across your selected frameworks. Use filters to find specific controls.
Loading controls...
// Terraform code will appear hereIf you disagree with the automated assessment, you can manually set the status.
No evidence documents linked to this control yet.
Generate and download compliance reports
High-level overview of your compliance posture
Complete evidence package for C3PAO submission
Detailed breakdown of compliance gaps and remediation
Infrastructure security findings and recommendations
Loading reports...
Review and remediate compliance gaps
Run an assessment to identify any compliance gaps in your environment.
Run AssessmentManage your personal account settings and preferences.
Your organization's details and compliance targets.
Select which compliance frameworks you want to assess against. Your assessments will evaluate your infrastructure and documents against the controls in your selected frameworks.
Manage who has access to your organization's account.
Connect InfraProof to your CI/CD pipelines for automated compliance scanning.
Create API keys to authenticate your CI/CD pipelines with InfraProof.
Connect GitHub to create auto-fix PRs directly from IaC findings.
Use this endpoint in your CI/CD pipeline to trigger IaC compliance scans.
https://infraproof.io/api/v1/webhooks/scan
# .github/workflows/compliance.yml
name: Compliance Check
on: [push, pull_request]
jobs:
scan:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- name: Scan IaC for Compliance
run: |
# Collect Terraform files
FILES=$(find . -name "*.tf" -exec sh -c '
echo "{\"path\": \"$(basename {})\", \"content\": $(cat {} | jq -Rs .)}"
' \; | jq -s '.')
# Send to InfraProof
RESULT=$(curl -sf -X POST \
https://infraproof.io/api/v1/webhooks/scan \
-H "X-API-Key: ${{ secrets.INFRAPROOF_API_KEY }}" \
-H "Content-Type: application/json" \
-d "{\"files\": $FILES}")
echo "$RESULT" | jq .
# Fail if critical/high issues found
CRITICAL=$(echo "$RESULT" | jq '.summary.critical + .summary.high')
if [ "$CRITICAL" -gt 0 ]; then
echo "::error::Found $CRITICAL critical/high compliance issues"
exit 1
fi# .gitlab-ci.yml
compliance-scan:
stage: test
image: alpine:latest
before_script:
- apk add --no-cache curl jq
script:
- |
# Collect Terraform files
FILES=$(find . -name "*.tf" -exec sh -c '
echo "{\"path\": \"$(basename {})\", \"content\": $(cat {} | jq -Rs .)}"
' \; | jq -s '.')
# Send to InfraProof
RESULT=$(curl -sf -X POST \
https://infraproof.io/api/v1/webhooks/scan \
-H "X-API-Key: $INFRAPROOF_API_KEY" \
-H "Content-Type: application/json" \
-d "{\"files\": $FILES}")
echo "$RESULT" | jq .
# Fail if critical/high issues found
CRITICAL=$(echo "$RESULT" | jq '.summary.critical + .summary.high')
if [ "$CRITICAL" -gt 0 ]; then
echo "Found $CRITICAL critical/high compliance issues"
exit 1
fi
rules:
- changes:
- "**/*.tf"# Simple cURL example
curl -X POST https://infraproof.io/api/v1/webhooks/scan \
-H "X-API-Key: ip_live_YOUR_KEY_HERE" \
-H "Content-Type: application/json" \
-d '{
"files": [
{
"path": "main.tf",
"content": "resource \"aws_s3_bucket\" \"example\" {\n bucket = \"my-bucket\"\n}"
}
]
}'Clean up orphaned data and manage your assessments.
View and manage compliance assessments across all projects.
Remove orphaned assessments and stale documents from your projects.
Irreversible actions. Proceed with caution.
Permanently delete all documents, assessments, and findings for a project.
Manage your subscription and billing information.
Basic compliance scanning for small teams
Unlock unlimited documents, assessments, and advanced features.
Payment methods and invoices will be available when you upgrade to a paid plan.
No billing information on file
Manage your account security and authentication settings.
Manage compliance for your applications and repositories
Create your first project to organize compliance for your applications.