Sources
Collectors connect to identity, cloud, code, HR, and ticketing systems and pull evidence on a schedule. Nothing is gathered by email in the week before an audit.
Platform
One workspace from source system to audit pack
Evidence is collected from the systems you already run, mapped to controls once, and filed in a single record that every module reads and writes. This page shows how the parts fit together.
- Modules
- 5
- Directory integrations
- 18
- Frameworks in the library
- 6
- Library controls mapped
- 373
How the platform fits together
Three layers. Source systems feed the five modules; the modules write to one evidence record; the outputs are generated from that record, so they can never disagree with each other.
Sources
Identity provider
Cloud accounts
Code hosting
HR records
Ticketing
Platform — five modules, one evidence record
Evidence collection
Policy management
Vendor assessments
Trust center
Risk register
Every module reads and writes the same dated, sourced evidence record
Outputs
Audit evidence pack
Trust center page
Board risk report
Auditor read-only view
Platform
Five modules share one evidence record. A single access review can satisfy SOC 2, ISO 27001, and GDPR controls at the same time, because the mapping lives in the record, not in a spreadsheet.
Outputs
The audit pack, the trust center, and the board report are all generated from the same record. When a figure changes, it changes everywhere it appears.
The five modules
Each module owns one part of the chain. Follow a module for its feature list, connected integrations, and deployment options.
Evidence collection
Evidence that gathers itself, dated and sourced
Connect the systems you already run and evidence is collected on schedule, labelled with its source, collection time, and the controls it supports. Auditors get read-only access to the exact items they asked for.
Policy management
Policies with owners, versions, and review dates
Write policies from maintained templates or your own text, route them for approval, collect staff acknowledgement, and keep a full version history that an auditor can read in one sitting.
Vendor assessments
Every vendor reviewed, every review on file
Send security questionnaires, track replies and documents, score risk by data access, and keep renewal reviews on a calendar instead of in someone's inbox.
Trust center
A public page that answers security questions once
Publish certifications, audit reports under NDA, subprocessor lists, and live service status on one page. Prospects stop emailing your team for documents, and every download is logged.
Risk register
Risks scored, treated, and reviewed on a cycle
Record risks with likelihood and impact, link them to the controls that treat them, and review the register on the schedule your framework expects. Accepted risks carry a named approver and an expiry date.
How it works
From scattered files to a filed audit pack
Four stages run all year, not once before the audit. Each stage works on the output of the stage before it, so the pack is never rebuilt from scratch.
-
Step 1 of 4
Collect
Policies, access reviews, scan results, and training records are pulled from the systems your team already runs, on a schedule you set. Nothing is chased by email in the week before an audit.
-
Step 2 of 4
Map
Each item is matched to every control it supports. A single access review can cover SOC 2, ISO 27001, and GDPR at the same time, and the mapping shows which requirement each file answers.
-
Step 3 of 4
Check
Controls are tested against the evidence on file. Anything missing or out of date is flagged with a named owner and a due date, months before the auditor arrives.
-
Step 4 of 4
File
When the audit opens, the evidence exports as one indexed archive — organised by control, dated, and ready to hand to the auditor in a single sitting.
Deployment summary
Module and integration counts are computed from the data files at build time. Module pages list the options module by module.
| Deployment | Modules supported | Directory integrations | Notes |
|---|---|---|---|
| Cloud | 5 of 5 — Evidence collection, Policy management, Vendor assessments, Trust center, Risk register | 16 of 18 | Hosted service. Collectors connect out to your systems; the workspace region sets where evidence is stored. |
| On-prem | 2 of 5 — Evidence collection, Risk register | 2 of 18 | Runs inside your network boundary for the modules that handle the most sensitive evidence. |
See the platform with your own systems
A demo connects two or three of your source systems and shows the first readiness picture from your own data.