About
One sentence pitch: LoxeAI is an open-core AWS Scanner & verifiable control mapper made for AWS-Native, lean, pre-Series A teams, once customers, investors, or enterprise starts asking (SOC 2 Type l tool).
Free: User connects via IAM-Role (Read-only), AI Agent collects evidence across 15 AWS services & maps it to 12 core SOC 2 controls (30 seconds to deploy, 5 mins to complete). Eliminates 40+ hours of manual evidence collection teams would otherwise spend on this-done in the click of a few buttons. Evidence items able to be shown in table format & exported to CSV. Data is stored in Cloudflare Workers infrastructure for 30 days. We never store AWS credentials. Every access to data is logged (so user has full transparency on what happened, where, etc). User can permanently delete all scan data at any time. All for free.
Paid: Once scan is complete, user has option to receive paid report of their findings ($99), in which every finding is traced back to the api-call that produced it, providing auditors with unfakeable evidence, full transparency. Reducing weeks of back & forth with auditors and clients and saving hundreds of thousands in lost enterprise deals. LoxeAI understands & wants to note that this doesn't solve the entire audit. The Evidence Infra layer+api-level verifiability covers roughly 30% of the entire audit. Thats where the compliance co-pilot-Gideon comes in. Gideon is an intelligent compliance chatbot that knows your workflow, helps with policy writing, risk assessment, remediations, auditor-questions. It reads your exact findings, your gap scores, and your AWS footprint, then tells you what to fix, in what order, with exact CLI commands. So when your auditor asks a question, you have an answer, not a spreadsheet.Remediation roadmap+human-in-the-loop control for reports included. Ability to mark findings as resolved, and scan history/deltas.
Note on verifiability positioning. Why is it important?
Because SOC 2 is fundamentally a trust problem, not a technical problem.
An auditor's job is to verify that your controls are operating effectively. The word "verify" is doing all the heavy lifting. They don't trust your dashboard. They don't trust your compliance platform's green checkmarks. They've been burned too many times by tools that said compliant while the underlying infrastructure wasn't. So they pull manual checks. They ask for the raw evidence. They want to see the thing itself, not a representation of the thing.
The specific failure mode that makes verifiability valuable: a company spends $15k on another GRC tool, gets a green dashboard, schedules an audit, and the auditor pulls a manual check on their S3 bucket policies or IAM configs and finds something the integration missed. Now the company has to explain why their compliance tool said one thing and reality said another. That conversation is expensive and embarrassing.
What SHA-256 hashing and API traceability actually solve: the auditor can look at a finding in your report and say, "3 IAM users without MFA, as of 2026-05-14T15:22:00Z, from iam.amazonaws.com/GetCredentialReport" and re-run that exact API call themselves. If they get the same result, the evidence is verified. If they get a different result, either the configuration changed since the scan (legitimate) or something was tampered with (the hash won't match). Either way, the chain of custody is clear.
Architecture
Stateless Cloudflare Worker. No persistent server, no VM, no container. Every scan request creates temporary AWS credentials via STS AssumeRole, runs the evidence collection, and exits. State lives in Cloudflare D1 (SQLite at the edge) for 30 days, then deletes automatically. Reports are stored in R2 object storage. The architecture was chosen for two reasons: it makes zero-credential-persistence easy to verify (no long-running process means no credential caching), and Cloudflare's infrastructure means your data doesn't pass through a server you have to trust us to secure.
Evidence Collection & Mapping Services:
LoxeAI recognizes the limited scope. But it owns it. Does this part better than any other tool on the market at the most efficient, trustworthy & affordable price.
AWS: Cloudtrail, S3, IAM, Config, Cloudwatch, SNS, EC2, VPC, KMS, SecurityHub, GuardDuty, WAF, RDS, Lambda, SSO, Secrets Manager.
Controls: CC6.1: Logical Access, Restricted Access, CC6.2: System Access Provisioning, CC6.3: Role-Based Access & Segregation, CC6.6: External Threat Boundary, CC6.7: Restricted Data Movement & Encryption, CC7.1:Configuration & Vulnerability Management, CC7.2:Security Event Monitoring, CC7.3:Anomaly Detection, CC7.4:Incident Response, CC8.1Change Management, CC5.2:Technology Controls, CC9.2:Business Continuity & Recovery