DevOps & Cloud · Infrastructure and compliance audit
StackAudit
One audit. Every angle.
Cost, change risk, backups, logging, data residency, lock-in, readiness, AI agents, SBOM, accessibility and privacy, gathered into a single report your client can act on.
$ duvaxa-audit run --client "Sample Co" --repo ./app --state state.json --plan plan.json --cur cur.csv --out audit
Cloud cost: about $861/month to save (14% of spend)
Change risk: critical, 17 changes, 9 destructive
Backup & disaster recovery: 9 findings, score 21/100
Production readiness: score 58/100, no tier yet
Report: audit/audit-report.html
The problem
A real audit needs ten tools and a week of stitching reports together. Clients want one report that says what to fix first and what it saves.
What it does
Collects evidence straight from AWS and GitHub: 16 read-only checks (MFA, CloudTrail, encryption, backups, branch protection, open alerts), hashed into an ISO 27001 / SOC 2 pack
Runs every relevant Duvaxa tool on the exports you can share: repository, Terraform state and plan, AWS Cost and Usage Report, website
One report: a card per area, the fixes to make first across all tools, and the evidence behind each
Keeps every tool's full report, linked from its section
Areas without an input are listed as not covered; a tool that fails is shown, and the rest still runs
Everything runs on our machine or yours: nothing is uploaded, and no secrets from Terraform state reach any report
White-label report for partners
How it works
- Share the exports you can: repository access, Terraform state, a month of the AWS bill, your website address
- We run the audit and review every finding
- Walk through the report and agree the fix plan
Works with
Your data
- Collectors use read-only credentials and keep evidence on your machine.
- Each finding links to the evidence behind it.
- No agent is installed in the client's environment.
Who it's for
Questions
Who is it for?
Consultancies and internal teams that need one defensible report instead of ten tool outputs stitched together.
How long does it take?
Collection runs in minutes; most of the time goes into reviewing the findings with the client.
Related
Often used with StackAudit
BlastRadar
Change impact analysisKnow what a change will touch. Before a release, see every service a change can affect and the line of code that links it. After the release, confirm those services are still healthy.
$300–600 (₹10,000–20,000 in India)View product → DevOps & CloudSLOStudio
SLOs and error budgetsReliability you can measure. Define each SLO in a few lines and get correct burn-rate alerts, an error budget everyone understands, and a release gate, on the monitoring you already run.
$1,500–3,000 (₹40,000–80,000 in India)View product → DevOps & CloudTestScope
Test impact selectionRun the tests that matter. Every pull request runs the tests its change can affect, each with a stated reason, and the full suite whenever a change is too broad to trust.
$1,000–2,500 (₹25,000–60,000 in India)View product →See StackAudit on your own data
A 30-minute call. We run the product on your export, repository or document and walk you through the results.