NSAuditor AI Enterprise Edition

REGISTER FOR YOUR LICENSE KEY (one time, after subscribing). Open https://www.nsauditor.com/ai/marketplace/register/  and enter: (a) your email, (b) the 12-digit AWS account ID holding this subscription, (c) your Agreement ID. WHERE TO FIND IT: starts with 'agmt-'. AWS Console -> AWS Marketplace -> Manage subscriptions -> NSAuditor AI Enterprise. It is checked against the agreement AWS reports for that account. Your ES256-signed license key (JWT) is emailed to that address. Or POST the same fields directly: curl -X POST https://api.licgw.com/v1/marketplace/register  -H "Content-Type: application/json" -d '{"email":"you@company.com ","awsAccountId":"123456789012","agreementId":"agmt-xxxxxxxx"}' Support: support@nsauditor.com .

PULL THE IMAGE. aws ecr get-login-password --region us-east-1 | docker login --username AWS --password-stdin 709825985650.dkr.ecr.us-east-1.amazonaws.com docker pull 709825985650.dkr.ecr.us-east-1.amazonaws.com/nsasoft-us/nsasoft/nsauditor-ai-enterprise:0.36.0

RUN WITH YOUR LICENSE. Pass it via NSAUDITOR_LICENSE_KEY (or mount a config volume and run license install <key> once): docker run --rm -e NSAUDITOR_LICENSE_KEY=<key> 709825985650.dkr.ecr.us-east-1.amazonaws.com/nsasoft-us/nsasoft/nsauditor-ai-enterprise:0.36.0 --help Suppression approvals are subcommands: compliance keygen (keypair; refuses to overwrite, since regenerating a key voids every signature it produced), compliance suppress (signs the approval it writes when NSAUDITOR_SIGNING_KEY names a local Ed25519 key, and a report checks that signature only for approvers whose registry entry carries key material), review / renew (renew warns it invalidates an existing signature). CLI-only. NEW IN 0.36.0: every compliance report cryptographically verifies each suppression signature it renders, for approvers whose registry entry carries key material. An entry may hold the approver's public key beside its fingerprint; the two must agree or the registry is refused at load. The verdict separates whether a suppression should stand from whether its bytes came from the key they name, diverging on a key revoked after it signed. A MISSING verdict means NOT CHECKED, never FAILED: an entry with only a fingerprint has nothing to check against, so the report reads "signed - not checked by this report". Cloud credentials are supplied read-only at runtime (-e AWS_* / mounted profiles). One image serves every tier; base / growth / scale differ only by the license key. Air-gapped operation: license validation is fully local (ES256, embedded key, no callback). Set NSAUDITOR_OFFLINE_ONLY=1 to serve CVE lookups locally and make the scan path fully offline; a configured egress path under it is refused at startup (exit 2), never skipped. Every other outbound path is opt-in and off by default (AI enrichment, GRC push, timestamping, KMS signing, NTP probe, monitoring webhook); the full register is in the image's docs (architecture 14.1.1). Opt-in RFC 3161 trusted timestamping, not yet exercised against a live Time-Stamp Authority from inside this exact image version: set NSAUDITOR_TSA_URL to the TSA you choose, outbound there only, no default TSA.

WHERE SENSITIVE INFORMATION IS STORED (Zero Data Exfiltration). All scan data - credentials, findings, configuration, and generated reports - stays inside YOUR environment (the container and any volumes you mount). The product sends no telemetry and has no SaaS backend, and no customer data is collected, transmitted, or stored by Nsasoft US LLC. Outbound connections are limited to the register above: by default your cloud provider's control plane (the scan itself), NVD CVE lookups (servable locally with NSAUDITOR_OFFLINE_ONLY=1) and SES DNS lookups during AWS scans; all else is opt-in and off by default. The only data we receive is the billing/fulfillment metadata above (AWS account ID, Agreement ID, registration email), processed solely to verify the subscription is yours and issue your license.