Compliance
Certifications, standards alignment and audit reports.
CloudFix is SOC 2 Type 2 audited, holds the AWS Cloud Operations Competency and is listed in AWS Marketplace. The reports behind those statements are available for your review.
Audited, partnered and listed
Certifications and partnerships
Independent assurance, and AWS’s own review.
SOC 2 Type 2
Audit period October 2024 to September 2025. Auditor: CyberGuard Compliance, LLP. Covers the security and availability trust services criteria. Zero exceptions noted. The report is available under NDA.
Audited
AWS Cloud Operations Competency
Validated by AWS for Cost Management: AWS reviewed CloudFix for delivering proven cost optimization.
Competency achieved
AWS ISV Accelerate Partner
A recognized AWS partner with co-sell support, available in AWS Marketplace for streamlined procurement.
Verified partner
- FinOps FoundationMember
FinOps Foundation Member
CloudFix is a member of the FinOps Foundation, the Linux Foundation community for cloud financial management.
Member
See the member listing
ISO 27001
Not currently held.
CloudFix does not currently hold ISO 27001 certification. Our primary independent assurance is the SOC 2 Type 2 audit, which covers our security and availability controls. For cloud software providers the SOC 2 framework is comparable in rigor to ISO 27001.
We review our certification roadmap annually. Contact us if ISO 27001 is a hard requirement for your procurement process.
Standards alignment
The frameworks CloudFix is built to.
CIS AWS Foundations Benchmark
CloudFix aligns with the benchmark where it applies to our infrastructure.
- IAM password policies and MFA enforcement
- Logging configuration (CloudTrail enabled)
- Encryption at rest and in transit
- Security group restrictions
- VPC flow logs
AWS Well-Architected: Security pillar
CloudFix follows the pillar’s design principles.
- A strong identity foundation: least-privilege IAM roles, no long-lived credentials
- Traceability: every fix operation is logged and auditable in CloudTrail
- Security at all layers: VPC isolation, security groups, encryption everywhere
- Automated best practices: CloudFormation onboarding, fixes as Systems Manager Automation runbooks
- Data protected in transit and at rest: TLS 1.2+ and AES-256
AWS Marketplace security review
CloudFix is listed in AWS Marketplace and passed AWS’s review for listed products.
- Product security assessment by AWS
- Secure integration patterns validated
- Compliance with AWS Marketplace terms
- Standardized billing through AWS
Documents
Compliance and security documentation.
The SOC 2 report and the penetration test summary require a signed NDA. Everything else is published here.
SOC 2 Type 2 report
Independent auditor report on CloudFix’s controls. Requires a signed NDA.
Request accessPenetration test summary
Summary of the most recent third-party penetration test. Requires a signed NDA.
Request accessData Processing Addendum
The DPA governing processing of personal data on your behalf.
View the DPAPrivacy policy
How CloudFix collects, uses and protects your information.
View the policyTerms of service
CloudFix and RightSpend terms, subscription terms and usage policies.
View the termsAWS partner verification
Verify CloudFix’s AWS partner status and listing.
View on AWS MarketplaceAPI documentation
REST API guide, endpoint reference and ITSM integration examples.
View the API docsArchitecture diagrams
Solution architecture and ITSM data flow for enterprise reviews.
View the diagrams
Need documentation for your review?
Request the SOC 2 Type 2 report, the DPA or other security documents. We respond within 2 business days.