Audit-ready compliance evidence from one read-only scan — SOC 2, HIPAA, NIST CSF 2.0, PCI DSS v4.0.1, ISO/IEC 27001:2022, CIS Controls v8, GDPR Article 32, and NIST SP 800-171 Rev 2, mapped from a single pass across AWS, Azure and GCP. 56 plugins, built on an open-source core. Runs entirely on your infrastructure — zero data exfiltration by architecture.
The cloud-audit + compliance engine shown above is NSAuditor AI Enterprise · Community Edition is free forever, MIT licensed
Runs entirely on your machine. No cloud. No telemetry. License validation is offline. We can't see your data because we never touch it.
Findings are risk-scored and ranked so you fix what matters first. Suppress accepted-risk or false-positive findings with the operator workflow — your triage decisions persist across scans.
OpenAI, Claude, or Ollama (fully local). Compliance reports, remediation guidance, risk prioritization. Your API keys, your data.
27 CE plugins: Ports, SSH, HTTP, TLS, DNS, SNMP, SMB, RPC, mDNS, UPnP, and more. 29 EE plugins, of which 28 are cloud auditors: AWS S3, GCP, Azure, IAM Deep Auditor, CloudTrail, API Gateway, DynamoDB, KMS, Lambda, Secrets+SSM, CodePipeline, IAM Decrypt-Path, S3 Lifecycle, AWS Backup, RDS, SES, VPC/PrivateLink, EC2 SG, ElastiCache, Inspector2/GuardDuty, plus dedicated Azure Storage / NSG perimeter / Key Vault deep auditors, and more. The 28th, Zero Trust Assessment, is not a cloud auditor — it scores zero-trust posture from a network-host scan and calls no cloud API.
SOC 2 (AICPA TSC 2017), HIPAA Security Rule §164.312, NIST CSF 2.0, PCI DSS v4.0.1, ISO/IEC 27001:2022, CIS Critical Security Controls v8, GDPR Article 32 (Security of Processing), and NIST SP 800-171 Rev 2 — all from one scan. Sub-requirement-level mapping for QSA RoC workflow. Defined-vs-Customized Approach discipline per Appendix E. CHD Scope operator-attested. ISO 27001 Statement of Applicability discipline. CIS Implementation Group cumulative discipline (IG1 cyber-insurance baseline). GDPR Article 32 is an infrastructure substrate for Art. 32 only (4 covered + 5 partial + 2 OOS across 11 sub-measure units) — NOT GDPR compliance. Auditor-ready evidence packs with SHA-256 chain-of-custody. Zero BAA required.
The MCP server ships free in the Community Edition — drive NSAuditor from Claude Desktop, Claude Code, Cursor, or any MCP-aware agent. Add it to your claude_desktop_config.json (npx nsauditor-ai-mcp), then install the optional agent skill so the assistant knows NSAuditor's tools, schemas, and audit workflows — in Claude Desktop: Skills → Create skill → Upload a skill (upload SKILL.md). Then just ask: "audit my AWS account."
Every scanner tells you what it found; the result that costs an audit is a clean page over a surface nothing examined. In EE 0.43.0 a cloud provider whose scanner did not run is reported as NOT audited, with the reason — its findings are absent rather than empty, the provider summary describes precisely what was scanned, and compliance verdicts keep failing closed over any unscanned surface. The rule is now unconditional across AWS, Azure and GCP: a cloud-plugin result that reports itself down carries either an error or an explicit skip flag, and the engine labels the two causes distinctly — plugin skipped (fix the scope) versus scanner error (fix a dependency or credential).
When a scanner cannot run, the evidence-gap sentence of every control it would have evidenced now states what was not evidenced — operator remediation stays on the operator channel, which matters most where a public-registry instruction cannot be followed. The restricted air-gap carrier is pinned to the dependency versions its own test suite runs against and builds reproducibly, byte-identical across consecutive builds, verified with the network interface down. Also: cleaner “Why this violates” rationale across four framework files, GDPR Article 32 (Security of Processing infrastructure substrate only, not GDPR compliance) fails closed on an Azure refusal, and the frozen interface record documents the envelope liveness keys. 29 Enterprise auditors (28 cloud auditors + one Zero Trust posture check), 56 plugins overall, all eight coverage matrices unchanged; floor unchanged at CE ≥ 0.2.49.
0.42.0 (27 August 2026): sovereign and government estates audited as themselves — partition-correct AWS auditing across GovCloud, China, the intelligence-community partitions and the European Sovereign Cloud, fail-closed Azure sovereign-cloud selection with every scan stamping the estate it addressed, an SBOM of the installed package and a published FIPS posture (FIPS-approved algorithms; not itself a FIPS 140-validated module). 0.41.0: the 29th plugin, the 1230 AWS DocumentDB Auditor, seven dimensions, every unreadable dimension a named evidence gap. 0.40.0: the eighth compliance framework — NIST SP 800-171 Rev 2 as evidence substrate for CMMC Level 2 preparation, all 110 Rev 2 requirements enumerated at the SP 800-171A determination-statement level. 0.40.3: the evidence chain checks itself — on the opt-in RFC 3161 path every timestamp token is matched against the exact artifact digest it attests before anything is written, and the verification instruction on the report cover page runs exactly as printed. 0.38.0: an evidence pack can be signed — compliance sign-pack signs one framework’s chain-of-custody envelope with an operator-held Ed25519 key, and compliance verify-pack establishes authorship and then recomputes every artifact hash against disk, because checking the signature alone would authenticate a manifest whose artifact claims nothing had verified. 0.37.0: vulnerability data you can carry onto a network that cannot fetch it — feed bundle merges the NVD files you downloaded, feed import ingests them on the isolated host. 0.36.0: a report stopped taking an approval record at its word and began checking the signature against the approver’s registered key material, with verified and cryptoValid kept as separate questions so a revoked key makes them disagree. 0.35.0: suppression approvals got a command line — an accepted risk carries an owner, a rationale, a date and an expiry. Full changelog →