Audit-ready compliance evidence from one read-only scan — SOC 2, HIPAA, NIST CSF 2.0, PCI DSS v4.0.1, ISO/IEC 27001:2022, CIS Controls v8 and GDPR Article 32, mapped from a single pass across AWS, Azure and GCP. 55 plugins, built on an open-source core. Runs entirely on your infrastructure — zero data exfiltration by architecture.
The cloud-audit + compliance engine shown above is NSAuditor AI Enterprise · Community Edition is free forever, MIT licensed
Runs entirely on your machine. No cloud. No telemetry. License validation is offline. We can't see your data because we never touch it.
Findings are risk-scored and ranked so you fix what matters first. Suppress accepted-risk or false-positive findings with the operator workflow — your triage decisions persist across scans.
OpenAI, Claude, or Ollama (fully local). Compliance reports, remediation guidance, risk prioritization. Your API keys, your data.
27 CE plugins: Ports, SSH, HTTP, TLS, DNS, SNMP, SMB, RPC, mDNS, UPnP, and more. 28 EE plugins, of which 27 are cloud auditors: AWS S3, GCP, Azure, IAM Deep Auditor, CloudTrail, API Gateway, DynamoDB, KMS, Lambda, Secrets+SSM, CodePipeline, IAM Decrypt-Path, S3 Lifecycle, AWS Backup, RDS, SES, VPC/PrivateLink, EC2 SG, ElastiCache, Inspector2/GuardDuty, plus dedicated Azure Storage / NSG perimeter / Key Vault deep auditors, and more. The 28th, Zero Trust Assessment, is not a cloud auditor — it scores zero-trust posture from a network-host scan and calls no cloud API.
SOC 2 (AICPA TSC 2017), HIPAA Security Rule §164.312, NIST CSF 2.0, PCI DSS v4.0.1, ISO/IEC 27001:2022, CIS Critical Security Controls v8, and GDPR Article 32 (Security of Processing) — all from one scan. Sub-requirement-level mapping for QSA RoC workflow. Defined-vs-Customized Approach discipline per Appendix E. CHD Scope operator-attested. ISO 27001 Statement of Applicability discipline. CIS Implementation Group cumulative discipline (IG1 cyber-insurance baseline). GDPR Article 32 is an infrastructure substrate for Art. 32 only (4 covered + 5 partial + 2 OOS across 11 sub-measure units) — NOT GDPR compliance. Auditor-ready evidence packs with SHA-256 chain-of-custody. Zero BAA required.
The MCP server ships free in the Community Edition — drive NSAuditor from Claude Desktop, Claude Code, Cursor, or any MCP-aware agent. Add it to your claude_desktop_config.json (npx nsauditor-ai-mcp), then install the optional agent skill so the assistant knows NSAuditor's tools, schemas, and audit workflows — in Claude Desktop: Skills → Create skill → Upload a skill (upload SKILL.md). Then just ask: "audit my AWS account."
Every assessor eventually asks how they know an evidence file was not edited after it was produced. All seven framework reports now answer it in writing. Set NSAUDITOR_TSA_URL to a Time-Stamp Authority you choose and every compliance artifact carries an RFC 3161 .tsr sidecar your auditor verifies offline with stock openssl — opt-in, no default ever, with none of our software in the path. Eleven compliance options that nothing could populate now receive values too; the entry points live in the Community Edition, so EE 0.33.1 requires CE 0.2.37 or newer.
The claim used to be a negative — nothing leaves — and a negative cannot be audited, because there is no list to check against. It has been rebuilt as a positive register of 17 enumerated outbound paths, each one named and accounted for. A reviewer now compares the register to the code instead of taking the absence on trust.
A signature record that does not say what signed it, and with what, cannot be verified by anyone who did not watch it being made. Algorithm and backend are now frozen into the record at creation — from the first byte, rather than inferred afterwards from whatever the current build happens to do.
Set NSAUDITOR_TSA_URL and the evidence pack is timestamped by the authority you name, verified against a real timestamp authority on 7 August 2026. It is opt-in and off by default, because it is an outbound call to a third party and the air-gapped posture does not make one unless you ask. Ed25519 suppression signing is still not reachable — no shipped entry point signs a suppression record — so evidence integrity rests on the SHA-256 chain-of-custody sidecars, which verify offline.
All seven coverage matrices are unchanged — SOC 2 10/4/37 · HIPAA 7/3/45 · NIST CSF 13/10/83 · PCI DSS 19/9/39 · ISO 27001 17/14/62 · CIS v8 17/23/113 · GDPR Art. 32 4/5/2. The plugin count is unchanged at 28 EE (55 in total), of which 27 are cloud auditors across AWS, Azure and GCP; the 28th, Zero Trust Assessment, scores posture from a network-host scan and calls no cloud API. All 28 install and load active.
0.32.11 (5 August 2026): the dependency-advisory release gate had been auditing the maintainer's development tree while calling itself the production closure — it now packs the tarball, installs it into an empty directory the way a customer does, and audits that, and it refuses to report clean until it has proved an advisory database actually answered. The two measurements barely overlap: development tree 25 advisories / 8 high, customer closure 6 / none high, sharing 5 of 26 packages and not one shared high. The SOC 2 matrix was also enumerated in full at 10 covered · 4 partial · 37 out of scope = 51 — enumeration completeness, not a coverage change. 0.32.9 (29 July 2026): internal engineering identifiers were stripped out of the evidence pack — 686 unexplained internal-marker occurrences → 0 across 105 files, with a positive control in the same run (3,572 benign matches still detected). And a cloud that could not be scanned stopped reading clean: every in-scope control of such a cloud now carries a fail-closed evidence gap. Two migration notes still apply when coming from 0.32.8 or earlier — the evidence-gap finding title changed, so suppression rules matching the old text stop matching (findings resurface rather than hide, but silently); and re-scan rather than re-process scans captured before 0.32.9. 0.32.8 (28 July 2026): capability-claim honesty pass, part 2 — 27 advertised claims across the three published packages were verified against the code and withdrawn: arm64 images, offline installation tarballs, monthly NVD feed bundles, an air-gapped install script, a feed-import CLI command with no implementation, and the Community Edition's absolute "works without internet access" claim. Both releases were matrix-neutral.