# Vishcore Inc.

> Vishcore Inc. fixes the AWS control gaps auditors and enterprise buyers ask about, in reviewable Terraform, and hands SaaS teams the evidence to prove it. Based in Calgary, Alberta, Canada.

Key facts:

- What Vishcore does: A read-only scan finds the gaps. We fix them in reviewable Terraform, hand over the evidence auditors and enterprise buyers ask for, and help keep it that way.
- Who it is for: Built for 5–200 person SaaS teams running production on AWS.
- How the read-only scan connects: Through a client-created cross-account role with an External ID, scoped to the Vishcore scanner allowlist. The role lives in your account, is owned by your team, and can be revoked at any time. Vishcore runs the scanner through that role, so your team installs nothing.
- What the scan never does: No writes, no Terraform, no secret values read from Secrets Manager, SSM, or KMS, and no remediation during discovery. The client-owned role explicitly denies Secrets Manager secret values and SSM parameter values, and it grants no KMS decrypt or key-material access. Some allowed configuration reads, such as CloudFront distribution settings, can include sensitive fields; the scanner reduces those responses to aliases and booleans before anything is stored.
- What discovery returns:
  - Posture snapshot: What is enabled, missing, or unclear across identity, logging, encryption, backups, disaster recovery, and exposure.
  - Severity map: What blocks the audit or buyer review first, separated from nice-to-have cleanup.
  - Remediation queue: Fixed-scope work items with owner, rollout order, and evidence target.
  - Evidence plan: Which configs, Terraform references, and restore notes will support your compliance process.
- Services and timing:
  - Cloud Control Scan (1–2 weeks): read-only scan and prioritized queue
  - Audit Blocker Remediation (after discovery): Terraform-backed fixes for the blockers
  - Compliance Cloud Modernization (phased): make the platform easier to audit and operate
  - Guardrails Retainer (ongoing): support after the sprint
- How to start: Start with a short note: the pressure point and the timeline. No secrets, account IDs, or access in the first message.
- SOC 2 audit or certification: No. The scan is not an audit opinion, a compliance certification, a penetration test, or a guarantee that an environment will meet SOC 2 requirements. The scan produces a discovery report that helps your team and your auditor see the same picture.
- Where Vishcore stops: Your controls stay yours. We fix the cloud ones and hand over the evidence; your compliance partner and your auditor cover the rest. We work alongside them and never sell an audit opinion.
- Client work: mfIQ (Mental fitness platform · SOC 2 Type II), XPAN (Enterprise learning services · multi-region failover), Forcify (Contractor management & timesheets · multi-account AWS), Fieldsafe (Field worker safety · Terraform-first remediation). Client names and quotes appear with each client's approval.
- Location and contact: Based in Calgary, Alberta, Canada. [hello@vishcore.com](mailto:hello@vishcore.com)

To start discovery, email [hello@vishcore.com](mailto:hello@vishcore.com?subject=Start%20Vishcore%20discovery). The [Start Discovery](https://vishcore.com/start-discovery) page has an intake form that prepares the same email.

Include in the first message:

- Cloud provider and scope: AWS, Azure, GCP, or mixed cloud; production, staging, or all environments.
- Pressure point: SOC 2, enterprise security review, buyer deadline, internal risk, or cloud-control concern.
- Current blocker: identity, logging, encryption, backups, restore proof, disaster recovery, network exposure, Terraform drift, or unknowns.
- IaC reality: where Terraform is trusted, partial, stale, or missing.
- Preferred outcome: discovery only, scoped remediation, migration support, or ongoing guardrails.

Never send in the first message:

- secrets
- passwords
- tokens
- access keys
- account IDs
- ARNs
- IP allowlists
- customer data
- production credentials
- keys
- private diagrams
- account numbers
- recovery diagrams

The fit check and scoping conversation happen before any AWS access is granted. Before any AWS access, serious buyers learn who will lead the engagement, with reference context and signed engagement terms. The first message stays free of secrets, account IDs, ARNs, and credentials.

Each page link below opens a Markdown copy of that vishcore.com page, built from the same source as the HTML. Cite the canonical URL in each copy's front matter.

## Overview

- [Home](https://vishcore.com/index.md): Vishcore Inc. fixes the AWS control gaps auditors and enterprise buyers ask about, in reviewable Terraform, and hands SaaS teams the evidence to prove it.
- [Engagement Model](https://vishcore.com/pricing.md): Vishcore scopes pricing after discovery, using fixed project delivery and optional ongoing support instead of open-ended hourly work.
- [Scan Check Contract](https://vishcore.com/scan/checks.md): What the Vishcore read-only Cloud Control Scan checks and what it does not check, in plain language. Five public scan checks with explicit boundaries.

## Explore

- [Services](https://vishcore.com/services.md): Four services: Cloud Control Scan, Audit Blocker Remediation, Compliance Cloud Modernization, and Guardrails Retainer. Fixes are scoped after the scan.
- [Cloud Control Scan](https://vishcore.com/scan.md): A read-only cloud control scan request path for SaaS teams preparing for SOC 2, enterprise reviews, disaster recovery evidence, or cloud-control pressure.
- [How It Works](https://vishcore.com/how-it-works.md): A six-frame engagement walkthrough: pressure point, read-only discovery, client-safe report, owner-context decision call, approved Terraform remediation, and evidence packet handoff.
- [Client Work](https://vishcore.com/case-studies.md): Selected Vishcore client work across cloud infrastructure, SOC 2 evidence support, disaster recovery readiness, production migration, and SaaS platform hardening.
- [About](https://vishcore.com/about.md): Vishcore Inc. is a cloud infrastructure consultancy focused on AWS, Terraform, SOC 2 infrastructure controls, and disaster recovery evidence.

## Resources

- [Resources](https://vishcore.com/resources.md): Open AWS resources from Vishcore with no email gate: the public AWS test library and the read-only discovery role template, each with a Markdown copy.
- [AWS Test Library](https://vishcore.com/resources/test-library.md): A representative set of the read-only AWS tests in the Vishcore scanner: what each checks, when it passes or fails, and its SOC 2 criteria and CIS v3.0.0 IDs. Also as JSON.
- [Read-Only Role Template](https://vishcore.com/resources/read-only-role.md): The CloudFormation template for the read-only role you create for a Vishcore scan, explained part by part, with AWS CLI commands to verify its denies yourself.

## Start here

- [Start Discovery](https://vishcore.com/start-discovery.md): Start a focused Vishcore fit check for cloud control gaps, SOC 2 pressure, enterprise reviews, disaster recovery evidence, or Terraform drift.
- [Discovery Worksheet](https://vishcore.com/discovery-worksheet.md): A print-friendly pre-discovery worksheet for cloud-control engagements: pressure point, cloud scope, regions, Terraform reality, timeline, stakeholders, known risks, and what not to send.

## Machine-readable files

- [llms-full.txt](https://vishcore.com/llms-full.txt): Every page listed here, in one Markdown file. Each page starts with its name as an H1 and a Source line with its canonical URL.
- [Scan checks contract](https://vishcore.com/api/scan-checks.json): The public read-only scan checks from the Scan Check Contract page, as JSON.
- [Scan checks contract schema](https://vishcore.com/api/scan-checks.schema.json): JSON Schema for the scan checks contract.
- [Sample scan report (Vishcore lab)](https://vishcore.com/samples/vishcore-lab/scan-report.html): The full HTML report of one read-only scan. Sample from a deliberately misconfigured Vishcore-owned lab with about a dozen resources. Not a client environment, and not a typical one. Not an audit opinion, not a compliance certification, not a penetration test. Under the published role, two of this run's tests, one of them Passing, would be “Not tested: read-only boundary”. SOC 2 and CIS references are Vishcore's mapping guidance, not an auditor's determination; CIS references are shown only where verified against CIS Amazon Web Services Foundations Benchmark v3.0.0.
- [Sample scan summary (Vishcore lab)](https://vishcore.com/sample-cloud-control-scan.json): The same lab run as the /scan sample: status counts, triage, attention queue, and owner-context worksheet, as JSON. The worksheet's owner questions and decision options are Vishcore guidance, not report output (guidance_source names the fields). Under the published role, two of this run's tests, one of them Passing, would be “Not tested: read-only boundary”.
- [AWS test library](https://vishcore.com/api/test-library.json): The tests on the AWS Test Library page, as JSON, with per-area counts for the library and the full catalog.
- [AWS test library schema](https://vishcore.com/api/test-library.schema.json): JSON Schema for the AWS test library.
- [Read-only role template](https://vishcore.com/resources/vishcore-read-only-discovery-role.cloudformation.yaml): The CloudFormation template that the Read-Only Role Template page explains, as published (YAML).
- [Sitemap](https://vishcore.com/sitemap.xml): Every indexable page URL.

## Optional

- [Privacy](https://vishcore.com/privacy.md): How Vishcore handles information from this informational site and email inquiries—engagements use separate agreements.
- [Terms](https://vishcore.com/terms.md): Site terms for vishcore.com: informational content only; client work is governed by signed contracts.