Graystum Labs founder@graystum.com
In development

Design partners welcome

Graystum Labs is building Wardhand, a compliance engineer that works inside your own cloud.

Wardhand is for SOC 2 first, with ISO 27001 next. It runs in your own AWS account, tests your controls every day with read-only access, and drafts each fix for a named person on your team to sign. Nothing leaves your account.

How it works

  1. 1It runs in your AWS account. You install Wardhand in an account you control. Your data is not sent to Graystum Labs, and Wardhand calls its AI model through your own AWS account.
  2. 2It tests your controls every day. Using read-only access, it checks your cloud, identity and code systems against the SOC 2 controls you have in scope.
  3. 3When a control fails, it drafts the fix. It explains what failed and why, then writes the change as a patch or a ticket in the tools your team already uses.
  4. 4A named person signs. Nothing is applied until someone on your team approves it under their own name. Wardhand does not change your systems by itself, and it never signs for you.
  5. 5The evidence is kept. Each test records its source, the query it ran and the raw response, so your auditor can run it again and check the result.

An example

An illustration of a drafted fix. It is not output from a real account.

Drafted by Wardhand Needs a signature

Turn on log file validation for the main audit trail

Why
Log file validation is off on the main CloudTrail trail, so an edit to past audit logs would go unnoticed.
Evidence
A read-only DescribeTrails call. The response is kept with the time and the query, so it can be run again.
Change
logging/cloudtrail.tf 
  resource "aws_cloudtrail" "main" {-   enable_log_file_validation = false+   enable_log_file_validation = true  }
Signed
Name and time of the person on your team who approves it

Who it is for

Small B2B software companies on AWS where the CTO or an engineer runs SOC 2 alongside their main job, usually because customers have asked for a Type II report. Wardhand is aimed at the recurring work: access reviews, offboarding, change records and the fixes that follow.

Status

Wardhand is in development and is not available yet. We are looking for a few design partners: companies on AWS that are preparing for SOC 2, or already in an audit window, and want to try it early and tell us what is wrong with it.

Write to founder@graystum.com