# StackGuardian — Full Content Reference

> StackGuardian is an enterprise-grade Infrastructure as Code (IaC) management platform that helps platform engineering, DevOps, Cloud, and SecOps teams discover, codify, govern, and orchestrate cloud infrastructure at scale. It provides AI-powered Terraform and OpenTofu code generation, workflow automation with standardized blueprints, and policy enforcement across multi-cloud environments. The platform follows a three-step model: Discover → Develop → Deploy.

Website: https://www.stackguardian.io/
Documentation: https://docs.stackguardian.io/docs/
GitHub: https://github.com/stackguardian
Platform App: https://app.stackguardian.io/

---

## Company Overview

- **Founded:** 2022
- **Headquarters:** Kardinaal Mercierplein 2, 2820 Mechelen, Belgium
- **Email:** info@stackguardian.io
- **Funding:** $10M Series A (September 2025), led by TIN Capital, with Volta Ventures and InvestLink
- **Team background:** Leadership from AWS, Palo Alto Networks, Cisco, and SAP

### Co-Founders & Leadership
- Akshat Tandon — Co-Founder
- Karl Driesen — Co-Founder
- Johannes Scheuerer — Head of Solution Architecture
- Frank Bergmann — Head of Sales

### Certifications & Memberships
- Linux Foundation member
- AWS Advanced Partner
- AWS Qualified Software Partner
- ServiceNow Certified Platform (certified integration)

### Notable Enterprise Customers
RheinEnergie, B. Braun, Deutsche Pfandbriefbank, bpost, Cloudpunks, MEWA, adorsys, Live EO, SpeakUp, Synergics

### Customer Quotes
- Jochen Maertens, CEO at Synergics: Misconfigurations led to drastic overspend that was very difficult to address — addressing that through StackGuardian was a strong business case.
- Erik Schubert, Cloud Architect at RheinEnergie: Combining agility and compliance had always been challenging and resulted in mistakes causing severe business impact.

---

## Platform Products

StackGuardian's platform consists of two core products: **SGCode** and **SGOrchestrator**. They are designed to work together and can be purchased separately or as a combined platform.

---

## SGCode — Codify and Govern Your Infrastructure

**URL:** https://www.stackguardian.io/platform/code
**Tagline:** Automatically discover, convert, and govern thousands of resources in minutes with AI-powered Terraform & OpenTofu generation.
**Free tier:** Available with 1 cloud account, no credit card required.

SGCode solves the ClickOps problem: it scans existing AWS, Azure, and GCP environments, automatically generates production-ready Terraform or OpenTofu configurations, and activates governance from day one. It eliminates the 1–5 hours of manual work per resource required by traditional IaC adoption methods.

### Core SGCode Features

**1. Automated Discovery & Conversion**
Continuously scans AWS, Azure, and GCP environments to discover all cloud resources and automatically generate production-ready Terraform and OpenTofu configurations. Supports greenfield and brownfield environments.

**2. Intelligent Pattern Recognition**
Analyzes naming conventions, resource tags, and resource relationships to correctly map dependencies and ensure generated IaC mirrors real application architecture — not generic resource dumps.

**3. State File Generation**
Automatically creates and manages Terraform state files, eliminating manual terraform import commands and reducing per-resource onboarding time from hours to minutes.

**4. Module-Aware Codification**
Analyzes existing code repositories to understand naming conventions, variables, and module structure. Generates code that aligns with organizational standards rather than producing opinionated templates.

**5. Immediate Drift Detection**
After conversion, continuously detects configuration drift between deployed resources and generated IaC. Enables rapid reconciliation and prevents hidden configuration risk from accumulating.

**6. Governance from Day One**
Applies StackGuardian policies and guardrails during the conversion process itself, ensuring newly codified infrastructure is compliant before it ever enters production.

**7. IaC Adoption Matrix**
Evaluates current infrastructure maturity across eight possible states (combinations of IaC code, cloud resources, and state files existing or not) and provides guided, automated recommendations to reach full IaC coverage.

IaC Adoption Matrix states:
- No code / No cloud / No state → Start with IaC-first creation
- No code / Cloud exists / No state → "Shadow Infrastructure" — import/discover and bring under IaC
- No code / Cloud exists / State exists → Legacy infra + orphaned state — recreate code or import resources
- Code / No cloud / No state → IaC defined but not deployed — plan and apply
- Code / No cloud / State exists → State mismatch — reconcile or remove old state
- Code / Cloud exists / No state → IaC + unmanaged infra — import resources into state
- Code / Cloud exists / State exists → Fully managed IaC (ideal scenario) — maintain through PRs; enforce guardrails

**8. Intelligent Grouping & Analysis**
Groups cloud resources by application patterns and relationships, not just by resource type, to create logically coherent IaC modules.

**9. Git Integration**
Pushes generated IaC directly to GitHub, GitLab, Bitbucket, Azure DevOps, or any other VCS. Code style matches existing team conventions so the output looks like your team wrote it.

**10. SG Kyro (AI Assistant)**
An AI assistant built into the platform that helps generate IaC code, troubleshoot errors, and optimize infrastructure configurations.

### SGCode Measurable Benefits
- Reduces per-resource codification from 1–5 hours to minutes
- Achieves production-ready IaC in weeks vs. 12–18 months of building internal tooling
- 1,800+ automated compliance checks aligned to CIS, PCI DSS, GDPR, SOX
- Supports regulated industries including GxP-compliant pharma and healthcare environments
- Achieves 100% IaC coverage across brownfield and greenfield infrastructure

---

## SGOrchestrator — Deploy Fast & Safe with Confidence

**URL:** https://www.stackguardian.io/platform/orchestrator
**Tagline:** Start with GitOps IaC pipelines for control, then evolve to a no-code self-service model within your IDP.

SGOrchestrator provides standardized infrastructure delivery through blueprints, policy enforcement, and workflow automation. It enables developers to self-provision safely through guardrailed templates, platform teams to standardize delivery centrally, and SecOps to enforce policies and drift control at scale.

### Core SGOrchestrator Features

**1. Workflow Templates**
Define standardized IaC workflows for Terraform and OpenTofu. Automate provisioning, updates, and lifecycle operations with built-in guardrails. Supports multi-trigger execution: Self-Service Portal, GitOps (PR/MR triggers), API, SDK, and Terraform provider.

**2. Stack Templates**
Compose standardized infrastructure templates into orchestrated stacks where outputs from one workflow seamlessly drive inputs for downstream workflows across complex, multi-tier applications.

**3. No-Code Policy Engine**
Enforce governance, compliance, and security guardrails using SGPolicy. Embed automated policy checks before deployment without writing code. Powered by OPA/Rego and StackGuardian Tirith (open-source).

Policy actions available: Warn, Approve, Fail
Compliance frameworks supported: CIS, PCI DSS, GDPR, SOX, EU standards
Built-in checks: 1,800+ automated checks

**4. Workflow Groups**
Organize stacks and workflows by team, domain, or environment with role-based access control (RBAC). Enables decentralized team ownership with centralized governance.

**5. Reference Variables**
Reuse outputs as inputs across workflows to enable modular, composable infrastructure pipelines. Eliminates hardcoded values and supports dynamic, environment-aware deployments.

**6. Drift Detection**
Continuously monitor, detect, and remediate infrastructure drift after deployment to maintain desired state. Provides audit trails for all changes.

**7. Self-Service Speed**
Launch compliant stacks in minutes through a no-code interface — no tickets, no platform bottlenecks, and no IaC expertise required from developers.

**8. NoCode Form Builder**
Visual interface for creating self-service request forms that generate compliant infrastructure without coding. Enables product teams to provision resources through guided forms.

**9. Approval Gates & Exception Handling**
Multi-stage approval workflows with configurable gates, exception handling, and external approval system integrations for enterprise organizations with strict change management requirements.

**10. Advanced Scheduling**
Schedule workflow runs and destroy operations on a time-based cadence for cost management and TTL enforcement.

### SGOrchestrator Measurable Benefits
- Developers self-provision in minutes without waiting for platform team intervention
- Eliminates 3–5 FTEs of maintenance overhead when replacing manual IDP processes
- Shift-left governance: policies enforced before deployment, not after audit
- Supports FinOps with TTL guardrails and cost visibility dashboards

---

## Use Cases

### 1. Self-Service Infrastructure Provisioning
**URL:** https://www.stackguardian.io/solution/use-case/developer-self-service

Empower development teams to deploy cloud resources quickly using pre-approved IaC templates while maintaining enterprise governance and compliance.

**Problem it solves:**
- Developers waiting days or weeks for manual platform team approvals
- Inconsistent configurations across teams and environments
- Compliance risks from manual or ad-hoc provisioning

**Solution:**
- Pre-defined, policy-driven IaC templates from the SGMarketplace template catalog
- Automated approval workflows with configurable gates
- Policy-as-Code integration (SGPolicy/Tirith or OPA)
- Granular RBAC aligned to organizational structure
- FinOps and cost visibility built in

**FAQ highlights:**
- Developers can deploy without Terraform or cloud expertise via the no-code UI
- Integrates with Backstage, ServiceNow, and any API-driven IDP
- Replaces ad hoc ticketing with standardized workflows and automated handoffs

### 2. Lifecycle Management
**URL:** https://www.stackguardian.io/solution/use-case/lifecycle-management

Streamline IaC lifecycle management from provisioning to decommissioning while maintaining governance and compliance throughout.

**Problem it solves:**
- Infrastructure drift accumulating over time
- Compliance gaps between provisioning and decommission
- Operational inefficiencies from managing disparate tools

**Solution:**
- Unified management across Terraform, OpenTofu, Ansible, and other IaC tools
- Automated tagging compliance
- Consistent guardrail enforcement throughout lifecycle
- Automated state file management

### 3. Governance & Compliance
**URL:** https://www.stackguardian.io/solution/use-case/iac-governance-compliance

Automate IaC governance and compliance by enforcing policies and continuously monitoring deployments for secure, auditable infrastructure at scale.

**Problem it solves:**
- Inconsistent policy enforcement across teams and cloud providers
- Misconfigurations causing security incidents and cost overruns
- Manual governance processes that cannot scale

**Solution:**
- No-Code Policy as Code supporting multiple IaC frameworks
- 1,800+ proactive automated checks
- Integration with existing policy frameworks (OPA, Checkov, Snyk, Wiz, etc.)
- Multi-cloud compliance monitoring: CIS, PCI DSS, GDPR, SOX

### 4. Visibility & Best Practice Insights
**URL:** https://www.stackguardian.io/solution/use-case/visibility-best-practice-insights

Gain visibility across the entire cloud and IaC landscape, turning raw data into actionable guidance for reliability, security, and cost efficiency.

**Problem it solves:**
- Cloud environments become a "black box" with no unified view
- Overspend from undetected idle or misconfigured resources
- Non-compliance going undetected until audit time

**Solution:**
- Insights Dashboards & Reporting across all managed accounts
- Complete cost optimization visibility with Infracost integration
- Traceability and audit trails for all infrastructure changes
- Misconfiguration detection across cost, security, compliance, and best practices

### 5. Day2Ops — Drift & Versioning
**URL:** https://www.stackguardian.io/solution/use-case/day2ops

Advanced drift detection and infrastructure versioning for operational excellence — continuously monitoring and maintaining environments against approved standards.

**Problem it solves:**
- No documentation of infrastructure changes leading to knowledge gaps
- No drift detection allowing configurations to diverge silently
- No disaster recovery capability when environments break

**Solution:**
- Automated state file management
- Full change visibility with audit trails
- Instant rollback to known good states
- Continuous drift monitoring with automated remediation workflows

### 6. Infra2Code (Terraform Code Generation)
**URL:** https://www.stackguardian.io/solution/use-case/infra2code

Transform legacy ClickOps cloud infrastructure into governed, version-controlled IaC using SGCode — eliminating manual codification efforts across AWS, Azure, and GCP.

**Problem it solves:**
- Organizations running workloads provisioned through ClickOps, legacy automation, or manual scripts cannot gain IaC coverage at scale
- Manual codification requires 1–5 hours per resource
- Institutional knowledge disappears when engineers leave
- Shadow IT creates growing security and compliance blind spots

**Solution:**
- AI-powered IaC generation (Terraform and OpenTofu)
- Automatic state file creation and management
- Code style matching aligned to existing team standards
- Immediate drift detection post-conversion
- IaC Adoption Matrix to guide brownfield environments

---

## Pricing

**URL:** https://www.stackguardian.io/pricing

Pricing is usage-based. All plans include unlimited users. Pricing consists of a platform fee plus usage-based charges for active workflows, cloud accounts, and SGCredits.

### Plans

**Free — $0/month**
- Unlimited users
- 600 SGCredits
- 1 cloud account
- 10 active workflows
- Email support

**Standard — $359/month**
- Unlimited users
- 2,000 SGCredits
- 3 cloud accounts
- 20 active workflows
- Next business day support

**Pro — $1,459/month**
- Unlimited users
- 2,500 SGCredits
- 10 cloud accounts
- 30 active workflows
- Priority next business day support

**Enterprise — Custom pricing (contact sales)**
- Unlimited users
- 5,000 SGCredits
- 100 cloud accounts
- 75 active workflows (add unlimited beyond)
- Enterprise priority support
- Dedicated customer success team
- Enterprise uptime SLA (99.9%)
- ServiceNow certified integration
- Backstage plugin
- Full SSO/SAML
- Custom RBAC roles
- External approval system
- Private runners

### Pay As You Grow (overage pricing)
- $0.20 per SGCredit
- $1.15/day per active workflow beyond plan limit
- $1.12/day per cloud account beyond plan limit

### What counts as an active workflow?
Any managed cloud deployment represented as a distinct entity where users can create, destroy, or redeploy IaC resources. Analogous to a Terraform workspace, CloudFormation stack, Pulumi stack, or Kubernetes namespace. Inactive = destroyed or manually marked inactive.

### Feature availability by tier
- Terraform / OpenTofu: All plans
- Drift detection: Basic on Free/Standard; Advanced + Remediation on Pro/Enterprise
- Custom benchmarks: Pro and Enterprise
- SG Kyro AI assistant: Pro and Enterprise
- Referencing (reference variables): Limited on Free/Standard; full on Pro/Enterprise
- Workflow steps: Pro and Enterprise
- NoCode Form Builder: Pro and Enterprise
- Terraform Provider: Pro and Enterprise
- Webhooks: Pro and Enterprise
- Self-hosted VCS support: Enterprise
- SSO / SAML: Enterprise
- Private runners: Enterprise
- Custom RBAC: Enterprise
- MCP Server: Enterprise
- Concurrent runs: Unlimited on all plans
- Public runners: All plans

### Payment methods
- AWS Marketplace
- Azure Marketplace
- Direct credit card
- Additional options through partners

---

## Integrations

**URL:** https://www.stackguardian.io/integrations
(Last updated: February 2026)

### IaC Tools
**Native:** Terraform, OpenTofu, AWS CloudFormation, Ansible, Kubectl, Helm, Azure Bicep
**Supported:** AWS CDK, ARM Templates, Pulumi, Kustomize, Terramate, Terragrunt, Crossplane, Python, Bash

### VCS & CI/CD
**Native:** GitHub, GitLab, Bitbucket, Azure DevOps
**Supported:** Gitea, Jenkins, Forgejo, CircleCI, Travis CI, TeamCity, DroneCI

### Developer Portals & ITSM
**Native:** ServiceNow (certified), Backstage
**Supported:** Jira, BMC Remedy, Port, OpsLevel, Cortex, PagerDuty

### Security & Posture
**Native:** StackGuardian Tirith, Checkov
**Supported:** Snyk, Wiz, Aqua Security, Orca Security, Lacework, Prisma Cloud, Bridgecrew

### Cloud Providers
AWS, Microsoft Azure, Google Cloud Platform (GCP)

---

## Policy Engine — Tirith

StackGuardian's policy engine is powered by **Tirith**, an open-source policy-as-code framework developed by StackGuardian.

- GitHub: https://github.com/StackGuardian/tirith
- Supports OPA/Rego policies alongside native SG Policy
- Customizable policy actions: Warn, Approve, Fail
- Centralized and team-level enforcement
- 1,800+ built-in automated checks
- Compliance frameworks: CIS Benchmarks, PCI DSS, GDPR, SOX, EU standards
- Integrates with cloud-native and third-party policy frameworks (Checkov, Snyk, Wiz, Prisma Cloud, etc.)

---

## MCP Server (Model Context Protocol)

StackGuardian introduced its MCP Server in February 2026 to enable AI-native infrastructure governance.

- Enables AI agents to interact with StackGuardian for intelligent automation
- Available on Enterprise plan
- Announcement: https://www.stackguardian.io/post/introducing-stackguardian-model-context-protocol-mcp
- Allows LLM-based toolchains to orchestrate infrastructure workflows, query policy status, and trigger deployments

---

## Developer Resources

- **Documentation:** https://docs.stackguardian.io/docs/
- **API Explorer:** https://docs.stackguardian.io/docs/api/overview/
- **Changelog:** https://docs.stackguardian.io/docs/changelog/latest/
- **SG CLI (GitHub):** https://github.com/StackGuardian/sg-cli
- **Community (Slack):** https://join.slack.com/t/stackguardian-ol78820/shared_invite/zt-2ksag36j9-OjmXqQmyXudgYrV6FmesIQ
- **Community (Stack Overflow):** https://stackoverflow.com/questions/tagged/stackguardian
- **GitHub Organization:** https://github.com/stackguardian
- **LinkedIn:** https://www.linkedin.com/company/stackguardian/

---

## Recent Blog Posts & Guides

All blog posts: https://www.stackguardian.io/blog

- **Terraform import at scale: what the docs don't tell you** (Jun 2026)
  https://www.stackguardian.io/post/terraform-import-at-scale-what-the-docs-dont-tell-you
  Import at scale is a fundamentally different problem from tutorial-level import. Covers state management, resource targeting, and production realities.

- **GitHub-Driven Terraform Workflows with StackGuardian** (Apr 2026)
  https://www.stackguardian.io/post/github-driven-terraform-workflows-with-stackguardian-full-guide-demo
  Full guide and demo: validate, review, and deploy infrastructure changes without leaving your pull request.

- **Codifying Legacy Azure Infrastructure with SGCode** (Apr 2026)
  https://www.stackguardian.io/post/codifying-legacy-azure-infrastructure-with-sgcode
  Live test case study on converting brownfield Azure resources to Terraform.

- **From ClickOps to Platform Engineering: How SGCode Closes the IaC Gap** (Apr 2026)
  https://www.stackguardian.io/post/from-clickops-to-platform-engineering-how-sgcode-closes-the-iac-gap
  Why ClickOps creates permanent technical debt and how automated codification closes the gap.

- **Accelerating IaC Adoption: The Ultimate Guide** (Apr 2026)
  https://www.stackguardian.io/post/accelerating-iac-adoption-the-ultimate-guide
  Covers the IaC Adoption Matrix, codifying legacy infrastructure, and avoiding ClickOps at scale.

- **Building an AWS Account Vending Machine with StackGuardian** (Mar 2026)
  https://www.stackguardian.io/post/building-an-aws-account-vending-machine-with-stackguardian
  Automated, self-service AWS account provisioning with guardrails using SGOrchestrator.

- **Terraforming Your Azure: Migrating from Bicep to Terraform** (Mar 2026)
  https://www.stackguardian.io/post/terraforming-your-azure-a-practical-guide-to-migrating-from-bicep-to-terraform
  Practical migration guide for teams that have outgrown Azure Bicep.

- **Introducing StackGuardian MCP — AI-Native Infrastructure Governance** (Feb 2026)
  https://www.stackguardian.io/post/introducing-stackguardian-model-context-protocol-mcp
  Announcement of StackGuardian's Model Context Protocol server for AI-agent-driven infrastructure management.

---

## Frequently Asked Questions

### General

**What is StackGuardian?**
StackGuardian is an enterprise IaC management platform combining AI-powered Terraform/OpenTofu code generation (SGCode) with workflow orchestration and policy enforcement (SGOrchestrator). It helps organizations achieve full IaC coverage, enforce compliance, and enable developer self-service provisioning.

**Who is StackGuardian for?**
Platform engineers, Cloud/DevOps engineers, and SecOps teams at mid-market to enterprise organizations running infrastructure on AWS, Azure, or GCP — especially those dealing with ClickOps debt, multi-cloud complexity, or compliance requirements.

**How does StackGuardian differ from Terraform Cloud/HCP Terraform?**
StackGuardian adds automated IaC discovery and code generation (converting existing cloud resources to Terraform), a no-code policy engine with 1,800+ checks, and self-service developer portals. It supports multiple IaC tools beyond Terraform (OpenTofu, Ansible, CloudFormation, Helm, etc.) and integrates natively with developer portals like Backstage and ServiceNow.

### SGCode FAQs

**Can SGCode convert existing AWS/Azure/GCP resources to Terraform?**
Yes. SGCode scans your cloud accounts, discovers all resources, and automatically generates production-ready Terraform or OpenTofu configurations including the state file.

**How long does conversion take?**
Converting infrastructure with SGCode takes weeks rather than the 12–18 months typically required to build internal tooling. Per-resource time drops from 1–5 hours to minutes.

**Does SGCode work in regulated industries?**
Yes. SGCode has been proven in GxP-compliant pharmaceutical and healthcare environments and supports the traceability and audit requirements of SOX, PCI DSS, GDPR, and CIS frameworks.

**Does generated code match our existing style?**
Yes. SGCode analyzes existing repositories to match naming conventions, variable patterns, and module structure rather than producing generic templates.

### SGOrchestrator FAQs

**Can developers provision without IaC knowledge?**
Yes. SGOrchestrator provides a no-code interface and guided deployment flows. Developers launch pre-approved infrastructure blueprints through a portal without needing Terraform expertise.

**Can StackGuardian integrate with Backstage?**
Yes. StackGuardian provides a native Backstage plugin that lets users discover, configure, and deploy IaC templates and workflows directly from the Backstage developer portal.

**Does StackGuardian integrate with ServiceNow?**
Yes, natively (certified). Users can trigger StackGuardian workflows from ServiceNow tickets, create stacks, run executions, and manage IT requests with built-in governance.

### Pricing FAQs

**Is there a free plan?**
Yes. The Free plan is available forever with 1 cloud account, 10 active workflows, 600 SGCredits, and unlimited users. No credit card required.

**Are private runners limited?**
No. StackGuardian does not limit the number of private runners. Organizations deploy as many as needed.

**Are parallel runs limited?**
No. Concurrent runs are unlimited on all plans.

**What is an SGCredit?**
SGCredits are consumed for AI-powered infrastructure creation (code generation features). Each plan includes a monthly allocation; additional credits cost $0.20 each.

---

## Legal & Trust

- **Trust Center:** https://stackguardian.trust.site/
- **Privacy Policy:** https://www.stackguardian.io/pages/privacy-policy
- **Terms & Conditions:** https://www.stackguardian.io/pages/terms-conditions
- **Security Policy:** https://www.stackguardian.io/pages/security-policy
- **Uptime SLA:** 99.5% (Free/Standard/Pro), 99.9% (Enterprise)

---

## Key URLs Summary

| Page | URL |
|------|-----|
| Homepage | https://www.stackguardian.io/ |
| SGCode | https://www.stackguardian.io/platform/code |
| SGOrchestrator | https://www.stackguardian.io/platform/orchestrator |
| Use Cases | https://www.stackguardian.io/use-cases |
| Self-Service Provisioning | https://www.stackguardian.io/solution/use-case/developer-self-service |
| Lifecycle Management | https://www.stackguardian.io/solution/use-case/lifecycle-management |
| Governance & Compliance | https://www.stackguardian.io/solution/use-case/iac-governance-compliance |
| Visibility Insights | https://www.stackguardian.io/solution/use-case/visibility-best-practice-insights |
| Day2Ops | https://www.stackguardian.io/solution/use-case/day2ops |
| Infra2Code / Terraform Generation | https://www.stackguardian.io/solution/use-case/infra2code |
| Integrations | https://www.stackguardian.io/integrations |
| Pricing | https://www.stackguardian.io/pricing |
| Documentation | https://docs.stackguardian.io/docs/ |
| API Reference | https://docs.stackguardian.io/docs/api/overview/ |
| Changelog | https://docs.stackguardian.io/docs/changelog/latest/ |
| Blog | https://www.stackguardian.io/blog |
| About | https://www.stackguardian.io/about |
| Contact | https://www.stackguardian.io/contact |
| Trust Center | https://stackguardian.trust.site/ |
| Get Started (Free) | https://www.stackguardian.io/get-started |
| Book a Demo | https://www.stackguardian.io/book-call |
| GitHub (Tirith OSS) | https://github.com/StackGuardian/tirith |
| GitHub (SG CLI) | https://github.com/StackGuardian/sg-cli |
| GitHub (Organization) | https://github.com/stackguardian |