veriQU - Partner Readiness Assessment

Find the blockers before AWS does.

The AWS Foundational Technical Review gates ACE eligibility, co-sell, and the "Request private offer" button on your solution listing. Most partners discover what is wrong only after a submission comes back marked Action required, having spent weeks preparing evidence against a moving target.

veriQU runs a read-only assessment of your AWS account against 166 checks derived from the FTR prerequisites, the AWS Marketplace SaaS product requirements, and the Well-Architected Framework pillars FTR actually gates - Security, Operational Excellence and Reliability. Every finding states its FTR consequence, not a generic severity: whether it blocks submission outright, whether it is likely to score a high-risk issue, or whether it is merely worth knowing.

It tells you what it could not check.

Forty-six of the 166 checks cannot be settled from any API - tenant isolation, control-plane ownership, incident response, recovery objectives, and the review of whether any third party sits in your data path. veriQU does not quietly pass those. It marks them unresolved, names exactly what a human must examine, and reports a scan completeness figure on the first page. A finding it could not resolve is never reported as a pass, and the verdict never reads "ready" while anything is outstanding.

That matters because the alternative is worse than no report: a clean-looking assessment built on an incomplete scan leads you to submit and fail.

What you get

• A verdict with every blocking item named, and the FTR prerequisites ordered as the chain they actually are - later ones stay locked until earlier ones pass, so remediating them out of order wastes time.
• A remediation plan with effort estimates, separating what configuration alone can remediate from what is genuine engineering work.
• Step-by-step remediation guides for each finding.
• One-click remediations for common account settings. Each one runs only after you review and approve it, in your own account.
• A draft AWS Well-Architected review, pre-answered from scan evidence, to finish with your reviewer.
• Evidence for every finding the scan could resolve, quotable in your own submission. Items it could not resolve carry the question to answer instead.
• Unlimited rescans for the 24-month term, because the workflow is remediate, rescan, confirm.

What it can see, and what it cannot

veriQU reads your AWS account through a cross-account IAM role you create from a CloudFormation template we provide. The role is read-only, requires an ExternalId, and explicitly denies S3 object reads, DynamoDB item reads, Secrets Manager secret values and KMS decryption - so stored customer data is out of reach by policy, not by promise.

It does read resource configuration, and you should know exactly what that includes: among other things, Lambda and ECS environment variables. That is deliberate - a credential sitting in plaintext in an environment variable is itself an FTR finding, and a scanner that could not see it would miss one of the most common Security-pillar issues. Configuration of that kind can contain sensitive values, which is why findings report the resource and variable name only and never the value, and why log redaction is applied to every field.

Review the template before you deploy it. Revoke access at any time by deleting the stack.

Choose your tier

veriQU has three ways to buy, plus a free scan to start:

• Free scan - Run the read-only assessment and get your full findings report at no charge.
• veriQU Assist - Guided remediation. The assessment, step-by-step remediation guides, 60+ one-click remediations you review and approve in your own account, a draft Well-Architected review, and a monthly check that re-scans and tells you if anything has drifted. One upfront charge per account, 24-month term.
• veriQU Continuous - Automatic remediation, every day. Everything in Assist, plus a daily pass that re-applies the settings you have already approved, so your account stays ready between scans instead of drifting back out. It rescans weekly, not monthly, and Ask veriQU interviews you to fill in your FTR documents for you to check and save. One upfront charge per account, 24-month term.
• veriQU Managed - Engineer-led. A Cloud Catalysts engineer runs veriQU with you and stays on until your FTR passes. Request a private offer.

The 5-account and 25-account bundles are discounted. For more than 25 accounts, request a private offer.

AWS infrastructure charges

veriQU is deployed by you, into your own account: you create a cross-account IAM role from a CloudFormation template we publish. Any AWS infrastructure charges you incur are billed to you by AWS separately from this subscription. An IAM role itself carries no AWS charge.

Getting started

Every step from subscribing to submitting your FTR, with screenshots and troubleshooting: https://veriqu.thecloudcatalysts.com/guide