Product · Platform and security teams who need to know, not hope.
Aspian Cloud records what is running in every environment as signed snapshots, by artifact fingerprint, and flags anything that reached production without an approved change, on any deploy tool.
- The problem
- Someone with old credentials runs a manual production deploy. Your compliance tool checked the pull request, so nobody notices until the incident.
- What it does
- Watches deploy events and what is actually running, matches each artifact to an approved change, and opens a drift item with who, what and when the moment one doesn’t match.
- The result
- A complete change list, including the changes that went around the process, and an environment that tells you when it stops being compliant.
payments-prod
Vercel · Gate · snapshot every deploy event
| Running | Deployment | Approved change |
|---|---|---|
| payments-api | dpl_4fQ2…9a | CHG-2291 · R. Lindqvist, J. Osei |
| merchant-dashboard | dpl_7Lk0…c3 | CHG-2284 · policy standard-copy-v3 |
| webhooks-worker | dpl_1Zt8…e7 | CHG-2279 · J. Osei |
Try the deploy someone with old credentials would run.
Three ways to resolve drift
Every resolution is itself a governed action, and it stays on the record.
- Approve it afterwards, as an emergency change with a reason.
- Roll back to the last approved version.
- Allowlist it with a reason, for third-party artifacts only.
Merged, deployed and working are different
A deploy is verified by the version the live service reports, not by a 200. Old instances can keep answering after a silent revert.
- Each state has its own proof and observation time.
- Code behind a flag that is switched off shows as dormant.
- If a snapshot reporter is down, the status reads Unknown, never Compliant.
See what shipped without approval in your last 90 days.
Install the GitHub App and the scan arrives in minutes: every repo scored, every unreviewed merge and unapproved deploy named. Nothing is blocked until you choose.
Ship like a startup. Prove it like a bank.