Questions, answered.

Is this a compliance certification?

No. TerraSov gives you infrastructure that implements the technical controls and the evidence trail to prove it. Your auditor still audits — the difference is what they find: annotated code, an enforcing CI gate, and evidence guides mapping each control to its clause, instead of a spreadsheet someone updates the week before.

Which frameworks are covered?

ISO 27001:2022 (Annex A), BSI C5:2020, ENS (Spain, RD 311/2022), the GDPR articles with direct technical implications (Art. 32 security, Art. 44+ transfers), NIS2 (Directive 2022/2555, the Art. 21(2) measures every national transposition must contain) and DORA (Regulation 2022/2554, the ICT risk-management articles financial entities put in vendor questionnaires). 26 controls crosswalked across all six — one implementation, six vocabularies.

What exactly do I get access to?

A private GitHub repository with 8 Terraform modules (org foundation with EU region-lock SCPs, IAM baseline, KMS, audit logging, network baseline, S3, RDS, CI/CD OIDC), the custom Checkov policy pack, the terrasov-gateworkflow, per-framework auditor evidence guides, and every future release while subscribed.

How do seats work?

A seat is a GitHub account with read access to the library. Solo includes 1, Team includes 5. You assign seats on the activate page; replace a teammate by emailing support.

What happens if I cancel?

Access stays active until the end of the paid period plus a 7-day grace window, then seats are revoked automatically. Code you already deployed keeps working — modules you've applied don't stop existing. You lose updates, policies and new releases.

Can I use the modules in client projects?

Yes — deploying infrastructure created with the modules is fine, for your own products or your clients'. Redistributing the module source, the policy pack or the evidence guides themselves (e.g. reselling them as a library) is not.

Why AWS only?

Because depth beats breadth for audits. The controls, SCPs and evidence commands are AWS-specific by design. If enough subscribers need another provider, that decision will be public on the roadmap.

Invoices and VAT?

Paddle is the merchant of record: it applies the correct VAT for your country (including reverse charge for EU businesses with a VAT ID) and issues invoices your accountant will accept without questions.

Do you offer trials?

The three open-source modules are the trial — same hardening, minus annotations, policies and evidence. If they fit your workflow, the subscription adds the compliance layer.