Attestiva
Request a demo

Compliance automation for SOC 2, ISO 27001, GDPR, and HIPAA

Audit evidence, ready before the auditor asks

Attestiva collects evidence from your stack, keeps policies current, and tracks vendor reviews in one workspace, so the next audit starts from proof instead of a scramble.

Request a demo See the platform

Evidence chain

25 sample controls across 6 frameworks — 15 passing, 10 need action. Sample data

CC6.1 Logical access restricted to authorised users Pass
CC6.6 Encryption for data in transit and at rest Pass
CC7.2 Change tickets approved before deployment Action
CC7.4 Incident response plan tested in the period Action
CC8.1 Vendor reviews completed for critical suppliers Pass
A.5.1 Information security policies approved and published Pass
A.8.2 Privileged access reviewed quarterly Pass
A.8.13 Backups tested with a restore exercise Action
A.6.3 Security awareness training completed by all staff Pass
A.5.19 Supplier security requirements in contracts Action
Art. 30 Record of processing activities current Pass
Art. 32 Pseudonymisation applied to analytics exports Action
Art. 33 Breach notification procedure rehearsed Pass
Art. 35 Impact assessment for the new data product Action
164.308(a)(1) Risk analysis refreshed for the current year Pass
164.308(a)(3) Workforce clearance records complete Action
164.312(b) Audit controls enabled on systems holding ePHI Pass
164.308(b)(1) Business associate agreements signed and filed Action
Req. 3 Stored account data inventory verified Action
Req. 8 Multi-factor authentication for all remote access Pass
Req. 11 Vulnerability scans run and findings triaged Action
Req. 12 Incident response plan roles confirmed Pass
1798.120 Opt-out requests honoured within the deadline Pass
1798.140 Consumer request log reviewed monthly Pass
1798.100 Notice at collection updated on all forms Pass

Sample evidence chain for SOC 2: 5 controls, 3 with evidence filed and passing, 2 still needing action. Across all 6 frameworks in the sample data: 25 controls, 15 passing and 10 needing action.

Readiness at a glance

Passing and open controls per framework, from the sample readiness data.

Sample data
Controls tracked
25
Passing
15
Needs action
10
Ready overall
60%
  • SOC 2 3 of 5 passing 60%
  • ISO 27001 3 of 5 passing 60%
  • GDPR 2 of 4 passing 50%
  • HIPAA 2 of 4 passing 50%
  • PCI DSS 2 of 4 passing 50%
  • CCPA / CPRA 3 of 3 passing 100%

Browse the framework library

Framework library

How it works

From scattered files to a filed audit pack

Four stages run all year, not once before the audit. Each stage works on the output of the stage before it, so the pack is never rebuilt from scratch.

  1. Step 1 of 4

    Collect

    Policies, access reviews, scan results, and training records are pulled from the systems your team already runs, on a schedule you set. Nothing is chased by email in the week before an audit.

  2. Step 2 of 4

    Map

    Each item is matched to every control it supports. A single access review can cover SOC 2, ISO 27001, and GDPR at the same time, and the mapping shows which requirement each file answers.

  3. Step 3 of 4

    Check

    Controls are tested against the evidence on file. Anything missing or out of date is flagged with a named owner and a due date, months before the auditor arrives.

  4. Step 4 of 4

    File

    When the audit opens, the evidence exports as one indexed archive — organised by control, dated, and ready to hand to the auditor in a single sitting.

Five modules, one evidence chain

Each module owns one part of the chain and writes to the same evidence record.

See the platform

Customer results, in sample figures

Case studies ship with placeholder company names and sample measurements.

All case studies

Pricing that scales with the frameworks you hold

Prices in USD, per month. Annual billing is charged once per year at the annual rate. Sample prices for template preview.

Sample data

Essentials

$390per month, billed annually

For a first audit on one or two frameworks, with the evidence basics in place.

  • 2 frameworks
  • 10 evidence integrations
  • Core policy template set
Compare plans

Professional

$790per month, billed annually

For companies holding several frameworks at once and answering security questionnaires weekly.

  • 6 frameworks
  • 40 evidence integrations
  • Full policy template library
Compare plans

Enterprise

Custom pricing

For groups with several entities, custom residency needs, and a dedicated audit calendar.

  • All current and future frameworks
  • Unlimited integrations and assessments
  • Per-entity readiness views
Compare plans

Questions, answered plainly

Start with the evidence you already have

Connect the systems your team already runs and see the first readiness picture from your own data.

Request a demo See the platform