Shift-left compliance
Catch compliance gaps in the pull request, before code ships.
Scan your Terraform plan against SOC 2, ISO 27001, EU AI Act, NIST AI RMF, and HIPAA. A suggested fix on findings that carry one, ready to copy. No cloud access required.
By design
Shift-left
Findings land in the pull request, before infrastructure is provisioned. Reviewers see compliance gaps next to the diff that introduced them.
Zero access
Pre-Flight reads your plan output locally. It never needs credentials, cloud roles, or network access to your environment.
Advisory & non-custodial
Git is the rollback; we never touch production. Pre-Flight reports findings and proposes fixes, you stay in control of every change.
What it checks
Pre-Flight maps misconfigurations across AWS, GCP, Azure, and Kubernetes to the controls your auditors care about.
Encryption at rest
- S3 bucket encryption
- RDS encryption
- EBS volume encryption
Public exposure
- S3 public access
- GCS public buckets
- Cloud SQL public IP
- Azure storage public access
Network ingress
- Open SSH/RDP, AWS Security Groups
- Open SSH/RDP, GCP firewall
- Open SSH/RDP, Azure NSG
Identity & access
- IAM wildcard-admin policies
Transport
- HTTP (non-TLS) load balancers
Kubernetes
- Privileged containers
- Host networking
Three ways to run it
Drop Pre-Flight into CI, run it from your terminal, or call the API directly. Each path scans the same plan output.
uses: troothllc/trooth-action@v1npx trooth scan plan.jsonPOST https://api.trooth.co/v1/preflight {"plan": <terraform show -json>}Works with the rest of Trooth.
One account, one witnessed evidence chain. Every product below reads from it.
Run your first scan free
Paste a plan, get an audit-ready Compliance Delta with cryptographically signed evidence. Advisory, Trooth never changes your infrastructure.
Run your first scan free