Plaza
🇯🇵Sign inCreate account
Theme
Language
🇺🇸English🇯🇵日本語
Sign inCreate account
AWS TODAY · GCP + AZURE NEXTPre-Vanta · Post-Vercel

Graduate from
prototype → production.

Plaza is the pre-Vanta for security and Vercel-class deploys — all in your own AWS account, with GCP and Azure next. You keep the keys and the access. Start free. Graduate to corporate controls and continuous compliance only when your business needs them.

1M+
lines of code
450+
Lambda functions
290+
security cards
PLAZA-TOWER-001
SCALE 1:1
REV. 4
L3 · COMPLIANCE PROL2 · CORPORATEL1 · FOUNDATIONL0 · FREE
L3 · COMPLIANCE PRO
$2,000/mo
Evidence
Monitor
Controls
Auditor
Attest
Reports
L2 · CORPORATE
$500/mo
MDM
Onboard
Endpoint
Policies
Vendors
Training
L1 · FOUNDATION
$30/mo + usage
VPC
RDS
Lambda
CDN
OIDC
CI/CD
L0 · FREE
Free
Root MFA
CloudTrail
OUs
SCPs
Encryption
Baseline
FIG. 01 — Maturity stack
§02 · The Maturity Curve

Four floors. Graduate when your business is ready.

Security is table stakes at L0. L1 hardens your product. L2 covers your company. L3 manages the audit. Larger teams: ask us about Enterprise.

L3 · COMPLIANCE PROL2 · CORPORATEL1 · FOUNDATIONL0 · FREE
L3 · COMPLIANCE PRO
$2,000/mo
Evidence
Monitor
Controls
Auditor
Attest
Reports
L2 · CORPORATE
$500/mo
MDM
Onboard
Endpoint
Policies
Vendors
Training
L1 · FOUNDATION
$30/mo + usage
VPC
RDS
Lambda
CDN
OIDC
CI/CD
L0 · FREE
Free
Root MFA
CloudTrail
OUs
SCPs
Encryption
Baseline
Save 25% yearly
LEVEL 3

Compliance Pro

$2,000/mo

Continuous evidence collection and audit management. Vanta / Drata–class, without the standalone SaaS tax.

EvidenceMonitorControlsAuditorAttestReports
§03 · Without Plaza

Five hours before the auditor. Every one of these would take a week.

Not the easy stuff. The controls that stop a SOC 2 report cold when the evidence isn't already running.

audit-readiness · T−5:00 → T−0:00
T−5:00
✗ Auditor asks: "show me 90 days of CloudTrail in a tamper-evident S3 bucket, cross-account, with Object Lock."
→ A free Level 0 card sets up an organization-wide CloudTrail with log file validation. Level 1 cards add a KMS key and S3 Object Lock in compliance mode.
T−4:12
✗ Need to prove every deploy to prod went through a reviewed PR, with no long-lived deploy keys.
→ Plaza generates GitHub Actions workflows that deploy with OIDC — no stored keys — and walks you through branch protection. At Level 3, your GitHub audit log is collected daily as evidence.
T−3:24
✗ Must demonstrate IAM least-privilege — no wildcard actions, no long-lived keys, no role chaining loops.
→ Plaza enables IAM Access Analyzer across your organization, and the CI it generates can run an IaC scan (Trivy, tfsec or Checkov) that fails the build at the severity you choose.
T−2:41
✗ Auditor wants network segmentation evidence: flow logs, SG diffs, and a diagram matching reality.
→ Plaza turns on centralized VPC Flow Logs and an org-wide Config aggregator, and diagrams the network it provisioned. At Level 3, Config and security groups are snapshotted as evidence.
T−1:55
✗ Data residency: prove customer PII never left ap-northeast-1, incl. KMS, backups, and replicas.
→ Plaza deploys a region-restriction SCP (free) and a data-residency SCP (Level 1). At Level 3, evidence is signed as it is collected and kept write-once for a year.
T−0:48
✗ Vendor management: SOC 2 reports for every subprocessor, plus DPA status, expiry tracking.
→ Plaza keeps a vendor and subprocessor register with review dates, and puts a reminder in your in-app inbox 30 days before a review is due.
§04 · What's Inside

Built in. Not bolted on.

01

Secure by Default

Private subnets, encryption at rest & in transit, zero-trust networking. Configured before you write a line of code.

02

Infrastructure Provisioning

Multi-tier AWS account structures, VPCs, security groups, IAM roles — provisioned with OIDC. No long-lived credentials.

03

CI/CD Pipelines

develop → test → staging → prod. Branch protection, OIDC-based deploys, CloudFront invalidations built in.

04

Multi-Environment

Separate tier accounts for frontend, backend, data — each with isolated boundaries and environment-specific config.

05

Continuous Auditing

Compliance checks against SOC 2, NIST, ISO 27001. Evidence collection and risk registry for audit readiness.

06

Policy Management

IAM policies, SCPs, security guardrails — generated, version-controlled, and tracked with full audit history.

§05 · How it works

Connect in fifteen minutes. Harden one card at a time.

STEP 01

Connect your cloud

Deploy one CloudFormation stack in your AWS account. Plaza assumes its role with an external ID, so no access keys are stored. Guided cards then build your accounts, VPCs and Transit Gateway.

✓ Connection stack deployed ✓ Role assumed with external ID ✓ No access keys stored → next: organization structure
STEP 02

Walk the path

Complete guided security cards — each hardens your architecture or CI/CD and counts toward SOC 2, ISO 27001 and NIST readiness.

✓ Root MFA enabled ✓ SCP: deny public buckets ✓ Counted toward SOC 2 readiness → next: IAM baseline
STEP 03

Ship with confidence

Push code through the GitHub Actions workflows Plaza generates. Deploys authenticate with OIDC — no long-lived keys — and land in your CloudTrail.

git push origin develop → deploy: develop ✓ → deploy: staging ✓ → deploy: prod ✓
§06 · What we're building

Cloud access for AI agents, tied to a human.

Plaza AIM gives each AI agent its own identity. A person hands it work from the project, signs what it may do, and can stop it at any time. It is in development; the screens below are design previews.

plaza.nakatomi.dev · design preview
Plaza design mock-up: a project's work board with issues in Backlog, Ready, In progress, Blocked and In review; one card shows a teammate's agent at work on it.Plaza design mock-up: a project's work board with issues in Backlog, Ready, In progress, Blocked and In review; one card shows a teammate's agent at work on it.

FIG. 02 — Design preview with demo data. Not available yet; details will change.

In developmentPlaza AIM

Work starts from the project

Open an issue on your project's board and see its scope and acceptance criteria before any agent touches it.

You sign what it may do

The environment, how long it may run, its budget, and what it may reach outside the project, on one page, signed with your passkey.

Short-lived, scoped access

The agent gets credentials for that task only. When its budget runs out it stops and asks you, and an emergency stop is always one click away.

In development

Software bills of materials, built by agents

A signed SBOM for every project and the infrastructure it runs on. Agents read your code, your build and what is actually deployed, then tell you which published advisories really affect you. A person approves every "not affected" call.

Every feature and its status
§07 · Questions

Frequently asked.

No. Everything Plaza builds runs in your own AWS account: your apps, your data, your logs and your encryption keys stay there. Access is yours to give and to take back. You grant it by deploying one CloudFormation stack; Plaza assumes its role with an external ID, so no access keys are stored, and deploys use OIDC with no long-lived keys. Delete the stack and Plaza's access ends.

Build your Plaza.

Free forever at Level 0. Graduate when your customers ask for SOC 2.

NO CREDIT CARD · NO LOCK-IN · DELETE ONE STACK TO REVOKE