Quickstart
The first five minutes: install the GitHub App, see your scan, and turn on a policy in Evaluate. Nothing is blocked until you choose.
1. Install the GitHub App
Run the free scan: no account, email confirmation or passkey. Install the read-only Aspian Cloud Scan GitHub App on your account or organisation, on all repositories or the ones you choose. It suggests fixes as links to your GitHub settings and never changes anything. For a governed workspace, tell us about your team and we set it up with you within one working day.
2. See your scan
The scan runs as soon as you come back from GitHub, without waiting for a nightly run. In under a minute it shows:
- every repo scored against the baseline: branch protection or rulesets, required reviews, stale approvals dismissed, code owner review, required status checks, force pushes and deletion blocked, read-only workflow tokens, CODEOWNERS and CI;
- the last 90 days of merges to the default branch with no independent review, by name;
- commits pushed to the default branch with no pull request, and production deploys to environments with no required reviewer;
- a fix list, each fix one click away in your GitHub settings, and the whole report as a JSON download.
3. Turn on a policy in Evaluate
Every policy starts in Evaluate. It shows how many recent changes it would have blocked, and whose, before it blocks anything. When you are ready, promote it to Warn, then Block, one group of repos at a time. Promoting a policy is itself a protected change with an approver.
Next: choose a control level per tool
| Level | What it does | Where |
|---|---|---|
| Observe | Watches deploy events and what is running, and flags anything without an approved change | Every integration |
| Gate | A required check inside your tool, so production waits for an Aspian approval | Integrations that support it |
| Hold | Aspian holds the only production deploy credentials and deploys approved, prebuilt output | Regulated and Sovereign |
How a change reaches production
- A person or an AI agent opens a change that closes an agreed work item and declares its scope.
- Aspian works out the risk from the diff. Protected paths raise it; automation can never lower it.
- Routine changes with all their evidence are approved by policy, and the policy version is recorded. Risky ones go to named approvers, who approve with a passkey bound to the change’s hash. The person who asked can never approve.
- The change deploys through your own tool, and is verified when the live service reports the shipped version.
- Every step is written to a signed, hash-chained audit trail, which feeds your Trust page and audit exports.
Verify a signed snapshot yourself
The quickest way to see how Aspian Cloud proves things is to check a signed snapshot yourself. Open the Trust sample, or run the verifier from the repository with Node 24:
node packages/trust/scripts/verify-snapshot.ts snapshot.json --public-key <base64 Ed25519 key>
# exit code 0 = valid, 1 = invalid, 2 = bad usageConventions
- Secrets are write-only. No API, tool, log or export returns a stored secret value.
- Money is in whole minor units everywhere in the API.