Overview
Cloud Reviewer provides comprehensive application security capabilities including SCA, SAST, DAST, MAST, XDR, and ASPM. It analyses 3rd party libraries, open-source components, performs Secret Scanning, detects IaC Misconfigurations, mobile binary analysis, and provides Cyber protection.
The platform supports vulnerability prioritization with intelligent remediation, broad DevOps integrations, and a service-led operating model designed for modern development teams.
Vulnerability Prioritization
Risk-based ranking of security flaws using multiple scoring dimensions:
- Risk Score — CVSS, Cyber Risk Graph, SSVC for comprehensive risk assessment
- Reachability — determines if vulnerable code paths are actually reachable in your application
- Exploitability — EPSS, KEV, LEV, CESS, VISS, VEX for real-world exploit likelihood
- Business Impact — PHI, PII, PCI data sensitivity, critical business priority, toxic combinations, technical debt assessment
Intelligent remediation provides improved productivity and cost savings by focusing developer effort on the vulnerabilities that matter most.
MCP Server
Model Context Protocol server built using FastMCP, exposing Team Reviewer operations in masking mode. Interfaces with Findings, Products, Engagements, and Notes.
- Data Security — local model deployment, PII/PHI/PCI masking to protect sensitive information
- LLM Agnostic — supports OpenAI, GPT-4, Claude Sonnet, Gemini and other models
- Chat Reporting — natural language interaction in 57 languages for querying security data
- Risk Reassessment — via OWASP ASVS framework for compliance validation
SAST
Static Application Security Testing scans uncompiled source code, recognizing all programming languages. Provides drill-down to findings details with custom reporting capabilities. Supports source code, compiled code, mobile code, low code, IaC and configuration files.
DAST
Dynamic Reviewer Safe-PenTest module provides blackbox and whitebox testing to detect client-side vulnerabilities in running applications. Tests web applications and APIs for security flaws that only manifest at runtime.
SCA
Software Composition Analysis identifies 3rd-party component vulnerabilities and license issues. Detects vulnerable libraries and frameworks, outdated dependencies, discontinued packages, embedded secrets, IaC misconfigurations, and license compliance risks. Generates 7 different SBOM formats.
Triage
Finding management with False Positive (FP) and Accepted Risk (AR) marking. Supports group-by collapse for efficient bulk operations and JIRA assignment for issue tracking integration.
DevOps Integration
Comprehensive CI/CD integration for automated security scanning:
- Remote Scan CI/CD — Jenkins, GitHub Actions, GitLab CI with AES-256 encryption and TLS 1.3
- IDE Integration — Visual Studio, Eclipse, Android Studio plugins for shift-left security
- GitHub/GitLab On-the-fly — scanning integrated directly into pull request and merge request workflows
SaaS Plans
| Plan | Description |
|---|---|
| Pay-per-Scan | Single scan purchases for on-demand analysis |
| Professional (Pay-per-User) | Unlimited SAST/SCA/DAST for subscribed users |
| Developer | Per-developer pricing, requires Professional plan |
| Enterprise | Custom pricing with premium support and dedicated infrastructure |
Advantages
- Flexibility — adapt the platform to your security workflow
- Scalability — grow from single developer to enterprise teams
- Accessibility — browser-based access from anywhere
- Availability — 98%+ uptime SLA
- Reliability — 99% data integrity guarantee
- Cost Saving — no infrastructure management overhead
- Security — AES-256 encryption, TLS 1.3, SOC2 audited infrastructure
- Privacy — EU Data Act compliant, GDPR ready
Code Security
Multiple code submission modes to meet different security requirements:
- Standard — folder upload with AES-256 encryption in transit and at rest
- GitHub/GitLab Integration — on-the-fly scanning where code is processed in memory, never stored
- Enhanced (Static Reviewer Local Analyzer)— code never leaves the developer’s PC. Only findings metadata is transmitted to the dashboard.
Datacenters & SLA
Italian Government
DC-A in Bergamo (Aruba Networks), ANSI/TIA-942 Rating 4, SLA 99.95%, armed surveillance 24/7, 60MW power, hydroelectric/photovoltaic energy.
International (EU)
cloudreviewer.net hosted in France, Germany, UK (DataDock, Contabo, Server4You). GDPR compliant, Kubernetes-based infrastructure.
United States
cloudreviewer.com in New York, Seattle, St. Louis. SOC2 audited facilities.
Asia-Pacific
cloudreviewer.biz in Mumbai, Noida, Sydney, Singapore, Tokyo. Tier 3/4 datacenters.
Certifications
- BCA-IMDA Green Mark Gold
- ISO/IEC 27001:2013
- ISO/IEC 20000-1:2011
- OC1 Type2 (SSAE18)
- ANSI/TIA-942-B Rated-3
- PCI DSS 4