Read your architecture before anyone else does.
Upload a diagram or your Terraform. In your browser, with no account, you get a pillar by pillar read where every finding quotes the provider's own documentation, and in partner mode you see what an AWS Competency validator will question.
0 bytes of your diagram uploaded
Your image is read locally with the File API and processed in your browser; it never touches a server. Want proof? Open your browser's DevTools, watch the Network tab, and run the review: you will not see your image leave your machine. The only thing sent anywhere is the email step, and it carries finding ids and your answers, never your diagram or your words.
1 · Add your diagram (optional)
Upload an image (PNG/JPG), a diagram source file (.drawio, Mermaid), or infrastructure code (Terraform, Bicep, CloudFormation, Kubernetes YAML). Source and IaC files are parsed for exact service names; images can be scanned with OCR. A CDK app's synthesized template is CloudFormation, so it already works. Either way it stays in your browser; the strongest signal is still what you tell us below.
2 · Which services are in it?
Select everything you use. This is what we check the cited best-practice rules against.
3 · What were you trying to do?
A sentence or two. We echo your own words back as evidence and use them to surface relevant checks (for example, mentioning a public endpoint). Your words stay in this browser.
Select at least one service or describe your setup to run the review.
Questions
Is my architecture diagram uploaded to a server?
No. The review runs in your browser using the File API, and your diagram never leaves your machine. You can check: open your browser's developer tools, watch the Network tab, and run a review. The only thing sent anywhere is the email step, and it carries the ids of the checks that fired and your answers to the production and intent questions, never the diagram, its text, or your description.
Do I need an account?
No. You see a preview with no email: a score, six pillar bars, and the top three findings in full. A work email opens the full report at once, in the same tab. We also email a link that reopens the report on any device for 7 days.
What does it cost?
The review is free, as often as you like. The report includes an itemized estimate at $175 an hour, plus the packaged engagement that fits what it found. Every price line is an estimate, not an offer; final pricing is by signed statement of work.
Are the citations real?
Yes. Every finding is joined to a human-verified knowledge base, and the quote and the link are copied from the provider's own documentation. The tool cannot write a citation. A scheduled job re-checks every quote against the live page each week.
What is partner validation readiness mode?
For AWS partners preparing a competency or Managed Service Provider (MSP) application. It runs the same six-pillar rules plus checks drawn from the public AWS validation checklists, and frames the results as what a validator will likely question. Khavion is independent and does not speak for AWS; approval decisions rest with AWS.
Which clouds does it cover?
AWS in depth across all six Well-Architected pillars. Azure, Google Cloud, Databricks, and Snowflake each have their own cited rule sets, smaller and growing, and common third-party services such as vector databases and model APIs are detected too. The report says what it does not yet cover.
How well does it read diagram images?
Text detection runs in your browser on an open OCR model. Clean exports read well; blurry or very small images get a plain message about what to re-export instead of a guess. Diagram source files (.drawio, Mermaid) and infrastructure code (Terraform, Bicep, CloudFormation, Kubernetes YAML) are read exactly, with no OCR. A CDK app's synthesized template is CloudFormation, so it works too.
Is this an audit?
No. It is a cited checklist built from what you describe and what the tool detects. Verify each item against your real configuration. A hands-on review of the running environment is a paid engagement, priced up front.
Khavion is an independent consulting firm and is not affiliated with, endorsed by, or sponsored by Amazon Web Services or Microsoft. Approval decisions rest with each provider.
Khavion is an independent firm. It does not speak for Amazon Web Services, is not endorsed or sponsored by AWS, and has no say in approval decisions. AWS decides.
Khavion is an independent consulting firm and is not affiliated with, endorsed by, or sponsored by Microsoft. Designation, specialization, and funding decisions rest with Microsoft.
More on how data is handled: security and data handling.