# Frequently asked questions > 45 answers about the iCompaas platform, onboarding and integrations, cloud access and data security, audits and frameworks, VAPT, plans, billing and support. - Source: https://support.icompaas.com/support/faq - Updated: 2026-11-12 - Publisher: iCompaas, Inc. (https://www.icompaas.com) ## About iCompaas ### What is iCompaas? The Platform Transforming Cybersecurity Compliance iCompaas (Infrastructure Compliance-as-a-Service) is an AI-powered platform that automates cloud cybersecurity compliance. It acts as your always-on security admin, scanning systems continuously to catch and fix issues before they become problems. See [Start Here](https://support.icompaas.com/support/solutions/folders/getting-started). Link: https://support.icompaas.com/support/faq#what-is-icompaas ### Which compliance frameworks does the iCompaas platform support? It covers globals like SOC 2, ISO 27001, HIPAA, GDPR, DPDP and NIST frameworks, plus regionals such as Germany's BSI C5. See the [compliance guides and control libraries](https://support.icompaas.com/compliance). Link: https://support.icompaas.com/support/faq#supported-frameworks ### What is the USP of iCompaas? iCompaas uses AI agents for streamlined workflows, blending security checks with cloud cost optimisation all in one affordable package. See [Cost Saving Recommendations](https://support.icompaas.com/support/solutions/62000111796). Link: https://support.icompaas.com/support/faq#icompaas-usp ### How does the platform speed up the audit process? It pulls real-time evidence like logs and configs automatically, no manual screenshots needed, turning months of prep into days. See [running change-evidence scans](https://support.icompaas.com/support/solutions/articles/onb_vcs_evidence-selecting-repositories-and-running-change-evidence-scans). Link: https://support.icompaas.com/support/faq#faster-audits ### What level of access does iCompaas need to my cloud accounts? Just read-only access (least privilege principle), so it observes without ever changing or deleting your data. See [Cloud Onboarding](https://support.icompaas.com/support/solutions/folders/cloud-onboarding) for each provider's setup. Link: https://support.icompaas.com/support/faq#cloud-access-level ### Does the platform support Vulnerability Assessment (VAPT)? Yes, it runs full VAPT on apps and networks with expert guidance on fixes and proof-of-remediation documentation. Scope a test in the [Web-VAPT and Mobile-VAPT questionnaire](https://support.icompaas.com/support/solutions/articles/onb_questionnaire-completing-the-compliance-questionnaire---proposal-scoping-web-vapt-and-mobile-vapt). Link: https://support.icompaas.com/support/faq#vapt-support ### What is a "Compliance Hub"? It's a central dashboard for managing people-related activities such as document signing and security training. Link: https://support.icompaas.com/support/faq#compliance-hub ### How does iCompaas differ from a simple compliance checklist? Checklists are static and manual; iCompaas is dynamic, with real-time monitoring, auto-evidence collection, and proactive fixes before audits. Link: https://support.icompaas.com/support/faq#vs-compliance-checklist ### How does the Compliance Platform work? It auto-discovers cloud assets, runs vulnerability scans, creates remediation tasks, and generates verification docs for constant audit readiness. Start with the [onboarding overview](https://support.icompaas.com/support/solutions/articles/onb_overview-icompaas-onboarding-connect-clouds-people-and-repos). Link: https://support.icompaas.com/support/faq#how-it-works ## Getting started & integrations ### How do I sign up for iCompaas? Sign up at [icompaas.com/signup/account](https://www.icompaas.com/signup/account/) with your corporate email address; personal addresses are rejected, and your organisation is set up under your email domain. Accept the verification email from the same browser session. See [Creating your iCompaas account](https://support.icompaas.com/support/solutions/articles/a_gen_ss_62000037934_b1a834266b-creating-your-icompaas-account-and-choosing-the-right-plan). Link: https://support.icompaas.com/support/faq#sign-up ### What should I set up first after signing in? Open **Account Settings → Onboarding**. Connect at least one cloud account (scans start when you click **Save & start scan**), fill in Proposal Scoping in the questionnaire, connect your identity provider, then connect your version control system and select repositories. See the [onboarding overview](https://support.icompaas.com/support/solutions/articles/onb_overview-icompaas-onboarding-connect-clouds-people-and-repos). Link: https://support.icompaas.com/support/faq#first-steps ### Which cloud providers can I connect to iCompaas? Step-by-step guides cover Amazon Web Services (AWS), Microsoft Azure, Google Cloud Platform (GCP), Utho, Railway, DigitalOcean and Oracle Cloud (OCI), each showing the role, key or token to create in that provider's console. [OVHcloud](https://www.icompaas.com/product-updates/ovhcloud-cloud-integration-349742) was added in October 2026, along with Supabase, Vercel and Cloudflare integrations. See [Cloud Onboarding](https://support.icompaas.com/support/solutions/folders/cloud-onboarding). Link: https://support.icompaas.com/support/faq#supported-clouds ### How do I connect my AWS account to iCompaas? In **Account settings & Onboarding → AWS**, name the environment, enter your 12-digit AWS Account ID and click **Launch CloudFormation stack**. In the AWS Console, using an account with administrator permissions, tick the IAM acknowledgement, click **Create Stack**, wait for CREATE\_COMPLETE, then click **Finish** in iCompaas. See [Connecting AWS](https://support.icompaas.com/support/solutions/articles/onb_cloud_aws-connecting-amazon-web-services-aws-to-icompaas). Link: https://support.icompaas.com/support/faq#connect-aws ### Which identity providers and code repositories can I connect? Personnel onboarding connects Google Workspace, Microsoft 365, Zoho Workspace and [Okta](https://www.icompaas.com/product-updates/okta-personnel-identity-integration-344550) (added in August 2026), so people, admin roles and 2FA status are tracked. VCS onboarding connects GitHub, GitLab and Bitbucket to collect change evidence from the repositories you select. See [Personnel Onboarding](https://support.icompaas.com/support/solutions/folders/personnel-onboarding) and [VCS Onboarding](https://support.icompaas.com/support/solutions/folders/version-control-onboarding). Link: https://support.icompaas.com/support/faq#identity-providers-and-repos ### Why does Google Workspace or Microsoft 365 block the iCompaas connection? If Google shows 'Access blocked', a Super Admin must mark iCompaas as Trusted under **Security → Access and data control → API controls → Manage App Access**; policy changes can take up to 24 hours. If Microsoft 365 says 'Need admin approval', complete the authorization with a Global Administrator account. See [Connecting Google Workspace](https://support.icompaas.com/support/solutions/articles/a_gen_ss_62000037934_104dac2620-connecting-google-workspace-to-icompaas) and [Connecting Microsoft 365](https://support.icompaas.com/support/solutions/articles/onb_personnel_m365-connecting-microsoft-365-to-icompaas). Link: https://support.icompaas.com/support/faq#workspace-connection-blocked ### How do I invite my team, and what roles are available? Go to **Settings → Users → Invite** and pick a role: Owner (full control, including billing), Admin (frameworks, policies, evidence and integrations, but no billing), Editor (implements controls, uploads evidence and runs scans, but can't delete) or Auditor (read-only plus evidence export). Invitations are single-use and expire after 7 days. See [Inviting your team](https://support.icompaas.com/support/solutions/articles/a_gen_ss_62000037934_6d09c9b282-inviting-your-team-and-assigning-roles). Link: https://support.icompaas.com/support/faq#invite-team-and-roles ## Using the platform ### How do I collect change evidence from my repositories? After connecting your VCS, open **Compliance Management → Change Evidence**, select repositories, click **Save selection**, then **Run scan**. The report lists pass, fail or unknown results per control; if the repository list is empty, go back to VCS onboarding and click **Sync**. See [Running change-evidence scans](https://support.icompaas.com/support/solutions/articles/onb_vcs_evidence-selecting-repositories-and-running-change-evidence-scans). Link: https://support.icompaas.com/support/faq#change-evidence ### How does iCompaas help me fix failed controls? The AI Remediation Assistant gives step-by-step guidance (console, CLI or policy updates) for failed controls across AWS, Azure and GCP, with prerequisites, impact on security, cost and availability, and rollback instructions. Because iCompaas has read-only access and never alters your configurations, you apply the changes. See the [AI Remediation Assistant update](https://www.icompaas.com/product-updates/ai-remediation-assistant-336254). Link: https://support.icompaas.com/support/faq#fix-failed-controls ### What is a Trust Center? A Trust Center is a secure portal for sharing security, privacy and compliance documents with customers and prospects. Public documents are viewable immediately; for Restricted ones, a visitor clicks **Request Access** and an admin approves or rejects the request, granting access to that requester only. See the [Trust Center overview](https://support.icompaas.com/support/solutions/articles/a_1783434793126454-trust-center-overview). Link: https://support.icompaas.com/support/faq#trust-center ### What does Device Management check on employee devices? It runs 12 checks across Linux, macOS and Windows: disk encryption (LUKS, FileVault, BitLocker), firewall, and malware protection (ClamAV, XProtect, Windows Real-time Protection), plus AppArmor or SELinux on Linux, Gatekeeper on macOS and Controlled Folder Access on Windows. See [Device Management](https://support.icompaas.com/support/solutions/c_1792072200729301). Link: https://support.icompaas.com/support/faq#device-management-checks ## Security, access & data ### What does the iCompaas CloudFormation stack create in my AWS account? It creates the IAM role **IndependentAuditorAccessRole**, secured with an ExternalId condition, with the AWS managed policies ReadOnlyAccess and SecurityAudit attached. iCompaas assumes the role through STS with your Account ID and ExternalId, and the temporary credentials are valid for 1 hour. See [Connecting AWS](https://support.icompaas.com/support/solutions/articles/onb_cloud_aws-connecting-amazon-web-services-aws-to-icompaas). Link: https://support.icompaas.com/support/faq#aws-cloudformation-stack ### How do I remove iCompaas access from my AWS account? Sign in to the AWS account, open the **CloudFormation** service, select the stack iCompaas created when you connected the account and click **Delete**. You can revoke any integration at any time, and access stops when it is disconnected. See [Deleting the iCompaas stack](https://support.icompaas.com/support/solutions/articles/62000231642-deleting-icompaas-stack-from-aws-account). Link: https://support.icompaas.com/support/faq#remove-aws-access ### Can I give iCompaas a read-only Railway token? No, Railway tokens have no read-only mode, so create the narrowest token you can (a workspace token for that workspace, or a project token) and treat it like a production secret. To rotate it, delete it in Railway and add a fresh one in iCompaas. See [Connecting Railway](https://support.icompaas.com/support/solutions/articles/onb_cloud_railway-connecting-railway-to-icompaas). Link: https://support.icompaas.com/support/faq#railway-token ### How is my data protected, and where is it stored? Data is encrypted with TLS 1.2+ in transit and AES-256 at rest, with keys managed and rotated in AWS KMS. The platform is hosted on AWS in the US (us-east-1 and us-west-2) across multiple availability zones. See the [Trust Center](https://www.icompaas.com/trust-center), which lists every subprocessor and its region. Link: https://support.icompaas.com/support/faq#data-protection-and-location ### Is iCompaas itself ISO 27001 certified and SOC 2 compliant? Per its [Trust Center](https://www.icompaas.com/trust-center), iCompaas lists an ISO/IEC 27001:2022 certificate (issued March 2026) and a SOC 2 Type II report from an independent CPA firm, and a DPA is available. The report, the certificate and the annual pen test summary are shared under a mutual NDA. Link: https://support.icompaas.com/support/faq#icompaas-certifications ### How long does iCompaas keep data from my integrations? Only as long as it is needed for your compliance objectives or required by law. It is securely deleted or anonymized on your request or when the contract ends. Send privacy questions to privacy@icompaas.com, or see the [privacy policy](https://www.icompaas.com/privacy-policy/). Link: https://support.icompaas.com/support/faq#data-retention ## Audits & frameworks ### Does iCompaas issue my SOC 2 report or ISO 27001 certificate? No, iCompaas is the readiness and evidence layer: control libraries, continuous cloud checks, policy templates and evidence export. A licensed CPA firm issues the SOC 2 report, and an accredited certification body issues the ISO 27001 certificate. See the [SOC 2 guide](https://support.icompaas.com/compliance/soc-2-trust-services-criteria). Link: https://support.icompaas.com/support/faq#who-issues-soc-2-and-iso-27001 ### Can my auditor access iCompaas? Yes, invite them with the **Auditor** role, which is read-only and can export audit-ready evidence packs. Auditors can also use the dedicated auditor login at **app.icompaas.com/auditor/** to review and approve processes and procedures. See [Inviting your team and assigning roles](https://support.icompaas.com/support/solutions/articles/a_gen_ss_62000037934_6d09c9b282-inviting-your-team-and-assigning-roles). Link: https://support.icompaas.com/support/faq#auditor-access ### What is the difference between SOC 2 Type 1 and Type 2? A Type 1 report gives an opinion on whether controls were suitably designed and implemented as of a date. A Type 2 also tests whether they operated effectively over a period, and is what customers usually mean by 'your SOC 2'. See the [SOC 2 guide](https://support.icompaas.com/compliance/soc-2-trust-services-criteria). Link: https://support.icompaas.com/support/faq#soc-2-type-1-vs-type-2 ### Should I get SOC 2 or ISO 27001? SOC 2 is a CPA firm's attestation report and dominates North American procurement; ISO 27001 is a certificate from an accredited certification body, valid three years with annual surveillance audits, and is more common elsewhere. The controls overlap heavily, so many companies run one control matrix for both. See the [ISO 27001 guide](https://support.icompaas.com/compliance/iso-27001-2022). Link: https://support.icompaas.com/support/faq#soc-2-or-iso-27001 ### Is there a HIPAA or GDPR certification? There is no HIPAA certification: HHS does not approve any, and customers accept a SOC 2 Type II report or a HITRUST assessment as evidence. GDPR has no mandatory certificate and none makes you 'GDPR compliant' (Article 42 schemes are voluntary); you must be able to demonstrate compliance on request. See the [HIPAA](https://support.icompaas.com/compliance/hipaa) and [GDPR](https://support.icompaas.com/compliance/gdpr) guides. Link: https://support.icompaas.com/support/faq#hipaa-gdpr-certification ### Do I need ISO 27001 before ISO 42001? No, ISO/IEC 42001 can be certified on its own, but it shares ISO 27001's clause structure, so the two can run as one integrated management system and be audited together. iCompaas ships AIMS templates such as an AI policy, an AI risk register and an AI impact assessment workflow. See the [ISO 42001 guide](https://support.icompaas.com/compliance/iso-42001-2023). Link: https://support.icompaas.com/support/faq#iso-27001-before-iso-42001 ### Does India's DPDP Act apply to companies outside India? Yes, the DPDP Act, 2023 applies to foreign SaaS companies that offer goods or services to people in India, with no establishment or size threshold. It is being phased in, and most Data Fiduciary duties, rights and penalties commence on 13 May 2027. See the [India DPDP Act guide](https://support.icompaas.com/compliance/india-dpdp-act-2023). Link: https://support.icompaas.com/support/faq#dpdp-act-outside-india ## VAPT & security testing ### What does iCompaas VAPT cover for web and mobile apps? Testing is manual-led. Web VAPT covers authenticated and unauthenticated testing of the app and its APIs, mapped to the OWASP Top 10:2025; Mobile VAPT is static and dynamic testing of the iOS or Android client and its backend, verified against OWASP MASVS v2.1. See [VAPT](https://www.icompaas.com/vapt). Link: https://support.icompaas.com/support/faq#vapt-scope ### How long does a VAPT engagement take? The VAPT page lists seven phases: scoping (1–3 days), recon and threat modeling (1–2), automated and manual assessment (3–7), exploitation and PoC (2–4), risk rating and reporting (2–3), remediation support through your fix window, then a 1–2 day retest. Retesting and the closure letter come at no extra cost. See [VAPT](https://www.icompaas.com/vapt). Link: https://support.icompaas.com/support/faq#vapt-timeline ### Can iCompaas help with a CERT-In security audit? Yes, iCompaas coordinates the CERT-In security audit that RBI, SEBI and other Indian regulatory bodies require for government and financial applications. The audit itself is conducted by CERT-In empanelled auditors and covers Safe-to-Host certification, alignment with the RBI and SEBI frameworks, and retesting. See [VAPT](https://www.icompaas.com/vapt). Link: https://support.icompaas.com/support/faq#cert-in-audit ### Can you test our AI or LLM application for prompt injection? Yes, iCompaas LLM VAPT red-teams AI and LLM applications for prompt injection, system prompt and data leakage, excessive agency, unsafe output handling and supply chain integrity. You onboard targets, run automated engagements, review findings with remediation guidance and track a posture score over time. See [LLM VAPT](https://www.icompaas.com/llm-vapt). Link: https://support.icompaas.com/support/faq#llm-vapt ### What is a passive scan? A passive scan examines your publicly visible footprint without accessing internal systems: subdomains, IPs and hosting, HTTP security headers, TLS, SPF/DKIM/DMARC, open ports, sensitive file and admin exposure, subdomain takeover risk and typosquatting. Findings are rated Critical to Low, with remediation guidance. See [Passive Scan](https://www.icompaas.com/passive-scan). Link: https://support.icompaas.com/support/faq#passive-scan ## Plans, billing & support ### Which iCompaas plan is right for me? It depends on how many cloud accounts you need to connect, how many frameworks you're working toward, and whether you want a continuous view or a one-off readiness assessment. To talk it through, use **Book a Demo** on [icompaas.com](https://www.icompaas.com/). See [Choosing the right plan](https://support.icompaas.com/support/solutions/articles/a_gen_ss_62000037934_b1a834266b-creating-your-icompaas-account-and-choosing-the-right-plan). Link: https://support.icompaas.com/support/faq#choosing-a-plan ### How do plan upgrades and downgrades work? Upgrades take effect immediately, and the prorated difference for the rest of the billing period is charged on your next invoice. Downgrades take effect at your next renewal, with no proration credits. See [Changing your plan](https://support.icompaas.com/support/solutions/articles/a_gen_ss_62000037935_4f954dcffb-changing-your-plan---upgrades-downgrades-and-proration). Link: https://support.icompaas.com/support/faq#plan-changes ### Can I get a refund if I cancel partway through a billing cycle? No. Under the [Terms of Use](https://www.icompaas.com/terms-of-use), subscriptions renew automatically at the end of each billing cycle. You can cancel the automatic renewal at any time, but there are no refunds for cancellations partway through a billing cycle. Link: https://support.icompaas.com/support/faq#refunds ### How do I apply a coupon code? Enter it at the **Plan & Billing** step of checkout, or go to **Settings → Billing → Manage subscription** and choose **Have a coupon?** Codes are case-sensitive, one coupon applies per subscription at a time, and annual-plan coupons don't work on monthly plans (or vice versa). See [How to apply a coupon code](https://support.icompaas.com/support/solutions/articles/a_gen_ss_62000037937_9cc7551d31-how-to-apply-a-coupon-code-at-checkout). Link: https://support.icompaas.com/support/faq#apply-coupon ### Why isn't my coupon code working? Common causes: the code has expired, is for a different plan or billing interval, was already redeemed, or has a geographic or currency restriction. AWS and Azure Marketplace discounts are applied in the marketplace, not as in-app coupons. See [coupon troubleshooting](https://support.icompaas.com/support/solutions/articles/a_gen_ss_62000037937_216d090fe4-my-coupon-code-isnt-working-troubleshooting), or [open a ticket](https://support.icompaas.com/support/tickets/new) with the code and a screenshot. Link: https://support.icompaas.com/support/faq#coupon-not-working ### How do I contact iCompaas support? [Open a ticket](https://support.icompaas.com/support/tickets/new), then track it with your ticket number and email, or sign in on [Track tickets](https://support.icompaas.com/support/tickets). You can also call or WhatsApp +91 63014 72100; the team is typically available 9 AM to 6 PM IST. Link: https://support.icompaas.com/support/faq#contact-support ### What does the iCompaas SLA cover, and how do I escalate? The [SLA](https://www.icompaas.com/sla/) commits to infrastructure scans every 12 hours, auditor coordination within 14 days of you sharing all necessary details, and VAPT reports within 30 days of scoping; certification timelines depend on you fixing Critical and High gaps promptly. A miss caused by iCompaas's performance extends your service by the delay. Escalate to Customer Success (customersuccess@icompaas.com), then the Compliance Manager. Link: https://support.icompaas.com/support/faq#sla-and-escalation