AWS TODAY · GCP + AZURE NEXT — YOUR CLOUD, YOUR DATA SOC 2 · ISO 27001 · HIPAA — COMPLIANCE FROM DAY ZERO PRE-VANTA · POST-VERCEL — GRADUATE FROM PROTOTYPE TO PRODUCTION AWS TODAY · GCP + AZURE NEXT — YOUR CLOUD, YOUR DATA SOC 2 · ISO 27001 · HIPAA — COMPLIANCE FROM DAY ZERO
Features · Plaza

Build it secure. Prove it as you go.

Most compliance tools watch what you have already built. Plaza helps you build it right in the first place, and records the proof along the way: procedures tied to your controls, policies tailored to your company, and evidence collected from the work itself.

Available

On for customers today.

Coming soon

Built and in testing. Not on for customers yet.

In development

Designed and being built now.

Planned

On the roadmap. Not started yet.

01 — HOW PLAZA IS ORGANIZED

Three domains. One floor.

Plaza splits security into three domains: the platform your company runs on, the people and devices that work there, and the projects you ship. All three stand on one organization-wide floor.

Organization floor
Guardrails and policies everyone inherits

Plaza applies service control policies at the root of your AWS organization. They block the riskiest actions in every account, including accounts you add later, and no project can switch them off. Production gets stricter guardrails on top. Your security policies set the same baseline for every person.

Available
Domain 01 · Platform

Platform Foundation

One per organization: the account structure, central logging and security tooling that everything else stands on.

  • Accounts and organizational units Available
  • Org-wide CloudTrail, Config and flow logs Available
  • GuardDuty and Security Hub Available
  • Single sign-on with IAM Identity Center Available
Domain 02 · Corporate

People and devices

How your company works day to day: who has access, and the laptops and phones they use.

  • Device fleet from your MDM Available
  • Device self-attestation Available
  • Training assignments and policy sign-off Available
  • Manage laptops and phones with Microsoft Intune Coming soon
Domain 03 · Projects

Application projects

Each app is its own project, with development, test, staging and production environments in separate cloud accounts. What a project has to do depends on its environments and the services it runs.

Marketing siteStatic pages on a CDN
Customer appCustomer data, in production
Internal toolsStaff only, behind single sign-on

Example projects. The bars show how much each one has to do; the first bar is the organization floor.

Set the floor once

Organization-wide guardrails cover every account, so you don't configure the basics project by project.

Match the work to the risk

A static site and an app holding customer data shouldn't carry the same requirements. Each project's security cards follow its environments and services.

PlannedTeams with their own posture

Next: assign projects to teams, and let a team hold its projects to a stricter standard while the organization floor stays in place.

02 — THE WORK BEHIND AN AUDIT

Five jobs, one place.

01 / 05Available

Procedures tied to your security controls

Every control comes with a procedure for meeting it. Plaza's security cards spell out the steps, the prerequisites and how to check the work is done, and many come with a guided wizard that does the setup for you. Close a card and the control it maps to moves toward ready, so your procedures and your compliance status never drift apart.

Cards
290+ guided security cards
Each card
Steps, prerequisites and validation criteria
Mapped to
80+ controls, linked to evidence types and policies
When done
Your readiness score updates
02 / 05Available

Policies written for your company, not a template

Start from more than 50 policy templates and let Plaza tailor them with AI to how your company actually works. Policy Copilot helps you revise them as things change. Nothing is published until a person approves it, and employees acknowledge the exact version they read.

Templates
50+ security policies
Tailoring
AI drafts, a person approves
Copilot
Revise policies in plain language
Sign-off
Employees acknowledge a specific version
03 / 05Coming soon

Security questionnaires, answered from your own records

Upload the security questionnaire a customer sent you, and Plaza drafts each answer from your policies, controls and evidence. Every answer shows where it came from, so you can check it before it goes out, and a person approves every answer.

Built and in testing. We will announce it on the Updates page when it is switched on.

Input
The questionnaire your customer sent
Sources
Your policies, controls and evidence
Each answer
Cites where it came from
Sign-off
A person approves every answer
04 / 05In development

Software bills of materials, built by agents

Plaza will keep a signed software bill of materials (SBOM) for every project and the infrastructure it runs on. Agents read your code, your build, what is actually deployed and how it is configured, so they find the packages no lockfile mentions. They check each component against published advisories and tell you which issues actually affect you.

In development. AWS first, with Azure and Google Cloud to follow.

Layers
Code, build, runtime and configuration
Format
CycloneDX, signed and stored in your own cloud account
Triage
Agents flag the vulnerabilities your code can reach
Sign-off
A person approves every "not affected" call
Evidence
Each snapshot counts toward your audit
05 / 05Planned

The right tools for your requirements

Meeting a control often means choosing a product: an identity provider, a device-management tool, a logging service. Security cards already walk you through some of these choices. Next, Plaza will recommend tools based on your frameworks, your cloud and what you already use, and show which controls each one helps you meet.

Planned. Weighing up tools right now? Tell us what you are comparing →

Today
Guided choices inside security cards, such as identity and device management
Planned
Recommendations matched to your frameworks and cloud
Planned
Which controls each tool helps you meet
03 — AVAILABLE TODAY

The rest of your program, in one place.

Readiness

Readiness you can explain

A readiness score for each framework, with the controls behind it, so you can see exactly what is holding you back. Certification roadmaps lay out what to do next.

Evidence

Evidence collected from the work

Collectors gather evidence from IAM, CloudTrail, AWS Config, deployments, GitHub audit logs, device management and your workforce directory. Evidence is signed and kept in write-once storage.

Auditors

An auditor portal

Give your auditor read-only access to your evidence, instead of a folder of PDFs assembled the night before.

Risk

Risk register

Track your risks in one register. AI suggests risks you might have missed, and you decide which ones to add.

Vendors

Vendor register

List the vendors that handle your data, with AI-assisted research on each one for you to review.

People

People and devices

An employee portal with no extra login, security training assignments with completion certificates, device attestation, and directory sync with Google Workspace.

Documentation

Security documentation

Produce your System Security Plan, ISMS documentation and Statement of Applicability inside Plaza.

Assistant

A compliance assistant

Ask questions about your controls, policies and evidence in plain language.

Integrations

Integrations

Connect your AWS account, Okta and Google Workspace. More connectors are on the way.

Which features you get depends on your plan. See pricing →

04 — FRAMEWORKS

Mapped to what your customers ask for.

  • SOC 2Security
  • ISO 270012022
  • HIPAAUS healthcare
  • GDPREU data protection
  • NIST SP 800-171SPRS score · CMMC levels
  • ATLAJapan defense-industry standard

Plaza tracks readiness and maps controls for each of these. How deep the coverage goes varies by framework. Ask us about yours →

05 — HOW WE BUILD

How we decide what to build.

01

Requirements before code

Features start as a written requirements document, which is reviewed, challenged and approved before any engineering starts. Writing it down first is how we keep the product focused on real problems.

02

Built where other tools stop

We keep close track of where today's compliance tools leave teams doing the work by hand, and design for those gaps. Other tools monitor what you have built. Plaza helps you build it with the monitoring already in place.

03

AI drafts, people decide

Plaza uses AI to tailor policies, suggest risks and research vendors. Every draft goes to a person for approval before it counts.

04

Labels you can trust

If this page says Available, customers can use it today. Everything else is labeled for what it is, and we announce changes on the Updates page.

Also on the way

Coming soon A public trust center

Share your security posture with prospects on a page you control, with watermarked document downloads.

In development Governance for AI agents

Give each AI agent its own identity, short-lived access to your cloud, a budget, approval steps and an emergency stop.

Ready when you are

Start free. Graduate when your customers ask for SOC 2.

Create account Talk to the team →