An honest security verdict for your AWS architecture
Import your CloudFormation template, or draw your architecture from scratch. Secure Layer checks every resource against the security rules that apply to it. Each rule comes with a fix a human has reviewed. You see what to change, and where to find it in the AWS console. When we can't verify something, we say so instead of guessing.
Free plan, no credit card.
Not ready to import a template?
Sixteen checks you can run on your own AWS account, from your own console, in 15 minutes. Nothing to install, nothing sent to us. Also available in French.
How it works
From template to verdict to fixed architecture
Sooner or later a customer, an insurer, or an auditor asks how your AWS is secured, and the question lands on whoever owns the account. Secure Layer is built for that engineer. Import or draw the architecture, get an honest verdict on every applicable rule, and fix what's actually wrong before you have to answer. You don't have to answer alone: invite a colleague to help, or send your AI agent.
- Import, get a verdict
Drop in a CloudFormation template. Every resource is checked against the security rules that apply to it, and every finding comes with remediation a human has reviewed, not just a rule ID.
- Design from the full palette
Draw any resource CloudFormation supports. The configuration forms expose the real properties, not a simplified subset.
- Your answers vs. your architecture
Answer a guided security questionnaire and get a maturity score. When your diagram contradicts an answer, we flag it. Claim encryption while the diagram shows an unencrypted bucket, and you'll see it.
- Three verdicts, never two
Pass, fail, or needs review. If a value can't be resolved from your template, it's shown as unresolved and the rule goes to needs review. Never a false pass.
- Generate the IaC
Turn the secured design into deployable code: CloudFormation, CDK, or Terraform. One click, every format your plan includes. On Enterprise, the same click also generates a hardened version of your architecture and scores it, so you see exactly what improves.
- Share the project, not the account
Invite an editor or a viewer by email. They see the same diagram and the same verdicts, and they work with your plan. No subscription of their own: accepting an invite is free.
- Send your AI agent instead
Secure Layer has a Model Context Protocol (MCP) server. Connect Claude or any MCP client, and your agent imports the real CloudFormation, answers the questionnaire with evidence from your codebase, and reads back the score. Verdicts stay computed on our servers, never invented by the agent.
Connect an agent- Delete everything yourself
One action cancels your subscription, erases your diagrams and answers, and verifies the erasure. No email, no ticket.
We never invent a pass.
Every rule verdict is pass, fail, or needs review. When your template hides a value, you get needs review, not a guessed pass. You get no points for what the check could not read.
Secure Layer reads the architecture you import or draw. It checks that architecture against the security guidance AWS itself publishes. From the findings, it walks you toward a design you can defend. It is not a runtime scanner, not an audit, and not a certification.
Already running Checkov or Prowler in CI? Keep them. They are good at linting code and live accounts. Secure Layer works one step earlier, on the architecture you are still designing.
Pricing
The same checks and the same verdicts on every plan
Pay for remediation guidance, code generation, and the full questionnaire, never for a better score. Upgrade in a click, cancel anytime, and the Free plan needs no card.
Prices exclude VAT. It is added at checkout based on your country.
Free
€0/month
Start free without a card- 1 project, unlimited versions
- Import CloudFormation templates or design from scratch
- Per-resource security scores with issue counts by severity
- 6 sample questionnaire questions, one per Well-Architected pillar
- Connect an AI agent through the Secure Layer MCP server
- No credit card required
Startup
€75/month excl. VAT
Start with StartupStart free, upgrade from the app. No sales call.
- Everything in Free
- Full Well-Architected questionnaire with maturity score
- Full remediation guidance on every finding
- Code generation, 150 credits/month. One credit generates all 5 plan formats
- Credit packs that never expire
- Risk acceptance, so a finding you reviewed stops showing as open
- Project sharing: up to 5 editors or viewers per project, working on your plan
- 10 projects
Enterprise
€299/month excl. VAT
Start with EnterpriseStart free, upgrade from the app. No sales call.
- Everything in Startup
- Security-hardened variant of every generated stack, with its own computed security score
- 1,000 generation credits/month
- CDK TypeScript L2 output, the idiomatic higher-level CDK style
- Up to 15 editors or viewers per project
- Unlimited projects
Need more generation credits?
One credit is one generation click and produces your architecture in every format your plan includes. On Enterprise the same click also produces the hardened variant. Packs never expire. Available on Startup and Enterprise plans.
Pack prices exclude VAT. It is added at checkout based on your country.
Leave anytime
Start free without a card. Credit packs never expire. And you can delete your account yourself, no email, no ticket.
The boundaries, out loud
Straight answers before you import a template
- Does Secure Layer connect to my AWS account?
- No. There is no IAM role to create and no credentials to hand over. Secure Layer reads the CloudFormation template you import, or the architecture you draw on the canvas. If your agent scans a live account over MCP, it uses your own credentials on your side, and only the template reaches us. The trade-off is real: we score what you describe, not what is running.
- Can the AI agent fake a good score?
- No. The agent submits your answers and reads the result, nothing more. Verdicts are computed on Secure Layer's servers by the same engine that scores the canvas. The model that talks to you cannot write its own grade. If a value cannot be checked, it comes back as needs-review, not a green.
- Do people I invite need their own subscription?
- No. Editors and viewers you invite work on your plan, not their own. Accepting an invite is free for them. On Startup you can invite up to 5 people per project. On Enterprise, up to 15.
- Can I import Terraform?
- No. Import is CloudFormation only today, JSON or YAML. If you run Terraform or Pulumi, you can still draw your architecture by hand. Terraform is a generation output. Secure Layer writes it for you, it just cannot read it back in yet.
- What happens when my generation credits run out?
- You buy a credit pack, or wait for the next monthly reset. Packs come in three sizes: 25 for €13, 100 for €40, 500 for €150. They never expire, so credits you paid for stay yours. One credit still generates every format in a single click.
- Is this a certification or an audit?
- No. Secure Layer is not a certification, and it is not an audit. It helps you prepare for both. You get real evidence: a scored architecture, plain-language findings, and answers ready for a due-diligence questionnaire. The certificate itself comes from your auditor, not from a tool.
- How do I cancel and delete my account?
- You delete your account yourself, from inside the product. One action cancels your subscription, erases your data, and verifies the erasure against a snapshot. No email, no ticket, no waiting on a human. You own the off switch.
- How is this different from tools I run in CI?
- Keep your CI tools. Checkov and Prowler are good at what they do: linting code and scanning live accounts. Secure Layer works one step earlier, on the architecture you are still designing, with nothing to connect. It explains every verdict in plain words. It tells you what it could not check, instead of passing it silently.
The person behind the honest verdict
I build Secure Layer, after 7+ years working at AWS Security. I got tired of tools that go quiet when they cannot check something. Silence reads as safe, and that is how a weak architecture passes a review it should fail. So Secure Layer never invents a green checkmark. When a rule cannot be checked from your template, you see needs-review, not a fake pass. You can test that promise on your own template today, for free.