Viwago
Turn the security scan you already run into audit-ready evidence
For: Security and GRC practitioners at small and mid-sized companies preparing for SOC 2 or ISO 27001 audits, plus the vCISOs and GRC consultancies that serve them.
Most companies already scan their cloud with open-source tools such as Powerpipe. The results are accurate, but they sit in a JSON file, and auditors, boards and enterprise customers need evidence shaped to a framework. Today that gap is closed either with weeks of manual spreadsheet work or with a GRC suite that needs agents and admin credentials in your environment.
Viwago is a translation engine, not a scanner. You run the scan yourself, with your own credentials, on your own machine, and upload the output. Viwago normalises and scores the results and maps them across several frameworks at once. Every number states where it came from, and where a framework has no data you see a dash, not a made-up 0%.
Each export carries a provenance seal based on the SHA-256 of the exact file you uploaded. An auditor can drop the export on Viwago's public verify page and the seal is recomputed in their own browser, with no account and no upload. Controls a scanner cannot check, such as physical access or offboarding, are covered through manual attestation.
It is built for security and GRC practitioners at small and mid-sized companies, and for the vCISOs and GRC consultants who serve them, typically while preparing for a SOC 2 or ISO 27001 audit.
5
Frameworks mapped from one CIS scan
4
Export formats: PDF, CSV, OSCAL, JSON
$99 / $299
Starter and Professional plans per month
What it does
Zero-custody ingestion of Powerpipe scan JSON: no agents, IAM roles or API keys
Cross-framework translation of CIS results to ISO 27001, SOC 2, NIST 800-53, HIPAA and PCI DSS, with version-pinned mapping profiles
Provenance on every score, including the SHA-256 of the uploaded file
Public in-browser seal verification using the Web Crypto API, with no account or upload
Manual attestation for controls a scanner cannot check, merged with automated results
Exports as board-ready PDF, CSV, NIST OSCAL and JSON
Honest gaps: unmapped frameworks show a dash rather than a fabricated score
Zero-Liability Procurement Kit for the customer's security review
How we architected it
- Next.js 14
- React 18
- TypeScript
- Tailwind CSS
- Firebase Auth
- Firestore
- firebase-admin
- pdf-lib
- papaparse
- Stripe
- Vercel
- Playwright
- Web Crypto API
- 01
Next.js 14 app on Vercel; a default-deny middleware lets only a vetted list of pages through
- 02
Ingest API accepts scan output through a pluggable adapter registry (Powerpipe and manual attestation today); a compliance service normalises, merges by control and scores
- 03
A framework mapping resolver maps CIS controls to each framework; an entitlement service decides which frameworks each pricing tier unlocks
- 04
Firestore is the production store, with tenant-isolated security rules and a default-deny catch-all
- 05
Tenant identity comes only from a verified Firebase ID-token claim and fails closed (no claim, no access); data is encrypted in transit and at rest
- 06
Report service renders CSV (formula-injection safe), JSON, OSCAL and PDF (pdf-lib); the provenance seal can be recomputed independently in the browser
- 07
An internal 'nine-gate' check fails the build if unproven capability claims reach the public site
Want something built like this?
Every build runs the same five gates: spec, architect, build, review, ship. It starts with a 48-hour audit.