Built to order
Compliance Automation
Evidence for SOC 2, ISO 27001, GDPR and HIPAA, collected continuously.
What it produces
Audit package: SOC 2, October
- Access control14 items
- Change management9 items, 1 exception closed
- Monitoring7 items
- People6 items
- Certification decisionYour auditor's
4 passed
Today
Screenshots chased the week before the audit.
With it
Evidence collected nightly, exceptions sent to their owner.
Watch it run
The nightly evidence run
Collector run: nightly
- 02:00:00 start scope=nightly framework=SOC 2
- 02:00:04 identity 48 users, MFA enforced on 48
- 02:00:09 code 23 repos, 1 without branch protection
- 02:00:12 cloud 3 accounts, audit logging on
- 02:00:15 people 2 leavers, access removed
Evidence written to the October folder.
Cloud, code, identity and HR systems are read on a schedule, never changed.
Control and data
A person decides
Owners decide every exception. Certification stays with your independent auditor.
Your data stays yours
Collected read-only and kept in your compliance platform or evidence store.
Connects to
In your accounts
Platform
- Vanta
- Drata
- Sprinto
Cloud
- AWS
- Google Cloud
- Microsoft Azure
Code, tickets
- GitHub
- Jira
Identity
- Okta
- Google Workspace
- Microsoft 365
Named for reference. No endorsement implied.
In full
Your control owners review every exception and approve every policy. We prepare the evidence; the attestation or certification decision stays with your independent auditor.
By default it runs in accounts and infrastructure in your name. If you would rather we run it, we host it in accounts set up only for you, kept separate from every other client. Evidence is collected with read-only access and kept in your compliance platform or evidence store. We do not claim certifications of our own, and our own security posture is published on our security page. How we handle data
Questions
Open one
Will this get us certified?
Nobody honest can promise that. Certification and attestation decisions belong to an independent auditor. What we do is make sure you arrive with complete, current evidence and controls that actually operate.
Are you certified yourselves?
No, and we will not claim a certification we do not hold. Our security page sets out exactly how we handle data, which providers we use and where they process it.
Which frameworks can you work with?
SOC 2, ISO 27001, GDPR and HIPAA are the most common, along with sector obligations such as AML/CTF record keeping. We tell you upfront when a framework needs a specialist we would bring in.
In detail
Open one
What it does
- Assesses your current position against the framework you need and writes up the gaps.
- Sets up a compliance platform such as Vanta, Drata or Sprinto, or builds evidence collectors where no platform fits.
- Collects evidence on a schedule from cloud, code, identity and HR systems.
- Monitors controls and alerts the owner when something drifts out of compliance.
- Drafts policies from templates for your team to review and adopt.
- Drafts answers to security questionnaires from your approved evidence and policies.
How we deliver it
The engagement runs in 5 phases, and you see progress at every one.
- 01Gap assessment. We review your current controls against the chosen framework and agree what needs to change.
- 02Systems are connected. Cloud accounts, code repositories, identity and HR systems are connected with read-only access.
- 03Evidence is collected on schedule. Collectors gather evidence and test controls continuously, instead of in a rush before the audit.
- 04Control owners review exceptions. When a control fails, the named owner gets the details and decides the fix.
- 05The audit package is ready. Your auditor receives an organised evidence set, and your team goes into interviews prepared.
Spec sheet
- Function
- Compliance
- Status
- Scoped with you and built for your business, using the same delivery process as every engagement.
- Connects to
- Vanta, Drata, Sprinto, AWS, Google Cloud, Microsoft Azure, GitHub, Okta, Google Workspace, Microsoft 365, Jira
- Built for
Walk into your next audit with the folder already full.
Tell us the framework and your systems. We will show you what can be collected for you.
Book a call (opens in a new tab)or email contact@strategicaiinnovations.com