Policy Lie Detector

Your policy says 90 days.
Your cloud says 365.

Snitch reads your security policy, turns every shall statement into a check it can run, tests each one against your live configuration and highlights every sentence your infrastructure contradicts. Its Chaos Monkey then breaks a canary resource on purpose and times how fast your own controls catch it.

Watch the film Run the demo

4. Cryptography

4.1All data at rest shall be encrypted with AES-256.

4.2Encryption keys shall be rotated every 90 days.

AWS KMS RotationPeriodInDays 365 policy requires 90

The film, 85 seconds

One sentence, from the PDF to signed evidence. Then the Chaos Monkey.

0:00The lie0:16Snitch0:20Read and check0:35Evidence0:42Every promise0:53The fix0:59Chaos Monkey

Narrated, with subtitles. Sound plays once you press play.

How it works

Follow one promise through Snitch

The same sentence from the film, step by step. Every policy sentence gets this treatment.

1

Claude reads the policy

Drop in the policy PDF. Claude finds every sentence that makes a promise, the shall statements an auditor will test.

4. Cryptography

4.1All data at rest shall be encrypted with AES-256.

4.2Encryption keys shall be rotated every 90 days.

Each promise becomes a check

The sentence turns into code that asks your cloud the same question the auditor will ask.

check_4_2.py

# 4.2  Encryption keys shall be rotated every 90 days.
def check_key_rotation(kms):
    for key in kms.list_keys()["Keys"]:
        status = kms.get_key_rotation_status(KeyId=key["KeyId"])
        assert status["KeyRotationEnabled"]
        assert status["RotationPeriodInDays"] <= 90

The check runs against live config

Snitch calls the real API and compares the answer with the promise. Here the keys rotate once a year.

kms:GetKeyRotationStatus

$ aws kms get-key-rotation-status --key-id 1234abcd-12ab-34cd-56ef-1234567890ab
{
    "KeyRotationEnabled": true,
    "KeyId": "1234abcd-12ab-34cd-56ef-1234567890ab",
    "RotationPeriodInDays": 365,
    "NextRotationDate": "2027-03-14T10:42:07+00:00"
}
✗ assert status["RotationPeriodInDays"] <= 90   365 > 90

4

The contradiction turns red

Snitch marks the sentence in the policy itself, with the evidence beside it. Then you fix the cloud or fix the policy, before an auditor finds the gap.

4.2Encryption keys shall be rotated every 90 days.

AWS KMS RotationPeriodInDays 365 policy requires 90

Demo

Run it on a sample policy

The policy from the film, with the results Snitch gave it there. Nothing on this page connects to a real account.

Sample policy, sample results

Information Security Policy

Version 3.2 · approved 12 March 2026 · owner: CISO

This policy applies to every system that stores or processes customer data. Exceptions need written approval from the CISO.

Brand kit

The mark is a polygraph trace

The wordmark is General Sans Bold. The line under it stays calm while a policy holds and swings red when it lies. Right-click any logo to save it, or copy its SVG.

snitch-logo.svg

snitch-logo-reverse.svg

snitch-icon.svg

Type: General Sans by the Indian Type Foundry, free from Fontshare, for the wordmark and headings. Inter for policy documents and JetBrains Mono for code. PNG versions at 2400 px and app icons at 512, 180 and 32 px ship with the kit.