Features
This page is the complete list — every screen, every capability, including the ones that are easy to miss and the ones we have deliberately not built yet. If something is not on this page, the product does not do it.
19-question assessment, 29 personalised requirements across six categories, per-requirement controls, and a readiness estimate you can watch move.
A ranked action plan, tasks with owners and multiple assignees, and recurring compliance work that reschedules itself.
Ten policy templates with approval and version history, a private evidence library, and twelve read-only connectors that collect proof for you.
A reminder engine for overdue tasks, expiring evidence and policy reviews — an in-app inbox plus optional push notifications.
Markdown and HTML policy export, and a full audit pack covering requirements, policies, evidence, tasks and the activity trail.
Four roles, invitations, an append-only activity log, and billing that a patched client cannot talk its way past.
Getting started
Name, website, headcount, industry and country. This is what makes the generated policies read like they were written for you rather than for a template.
Pick the cloud, code host, identity provider and work tools you actually use. Your answers shape the requirements and pre-select the connectors worth adding.
Five short sections — security, access control, infrastructure, people, vendors. Plain English, no jargon. A "no" is not a failure; it is what becomes your plan.
You can run more than one company from the same account on a paid plan, and switch between them without signing out.
Dashboard
Every requirement is scored — complete counts in full, "needs evidence" earns most of the credit because the practice exists and only the proof is missing, and anything not applicable is excluded from the denominator entirely. A requirement driven by several answers takes the worst of them, so one weak link is never hidden behind a stronger one.
A chart of the estimate as it moves, so progress is visible to the person who has to report it upward.
Access control, infrastructure, people, policies, security and vendors — ordered so the next free hour goes where it buys the most.
The handful of items that need attention now, plus a live feed of what everyone on the team has just done.
The percentage is our readiness estimate, not an official SOC 2 score. The app says so on the same screen that shows it.
Requirements
Each requirement arrives with a status already derived from your own answers, so you start from a real position rather than from zero.
Policies (10), infrastructure (5), access control (4), people (3), security (3) and vendors (3) — filterable by status and category.
Complete, needs evidence, needs action, not started, and not applicable — the last excluded from scoring rather than quietly counted against you.
Each requirement breaks into the specific controls that satisfy it, each marked satisfied or unsatisfied and linkable to the evidence that proves it.
Assign an owner and a due date, read what an auditor will actually ask for, and generate a plain-English summary of why the requirement exists at all.
Each requirement also links straight to the policy that would satisfy it and the evidence hint describing what proof looks like.
Action plan
A ranked plan rather than a backlog: the steps that move readiness most right now, each with an owner, an effort estimate, the requirement it advances and the evidence it will produce. One tap turns any step into a task with a due date.
The trial shows the first step. The full plan is part of a paid plan.
Policies
| Included templates |
|---|
| Information Security Policy |
| Access Control Policy |
| Password Management Policy |
| Incident Response Policy |
| Vendor Management Policy |
| Data Retention Policy |
| Business Continuity Policy |
| Change Management Policy |
| Acceptable Use Policy |
| Security Awareness Policy |
Templates fill themselves in from your company details and your stack. Optional AI generation rewrites a draft in your own context — and the templates work perfectly well without it.
Edit in the app, submit for approval, and have an owner or admin approve it. The requirement it satisfies flips to complete on approval.
Each save writes a new version with its author and timestamp. History is readable but not rewritable from the app — an auditor's favourite property.
Each policy carries a review interval and a next-review date, and the reminder engine chases it when it comes due.
Export any policy, or the whole set, as Markdown or as HTML that opens anywhere and prints to PDF.
Evidence
Photograph a signed document, pick a file, or attach a screenshot straight from your phone. Title, description, category and the requirement it supports.
AI classification reads the file and proposes which requirement it proves and how long it stays valid. Without AI, keyword matching does a reasonable job.
Every file has a review date and an expiration date, and a status of current, expiring, expired or rejected. Stale proof is a finding; the app catches it first.
Files live in a private bucket, downloads use short-lived signed links, and each access is written to a log the client cannot edit.
Attaching evidence to a requirement flips it to complete automatically.
Integrations
The quarterly screenshot chore becomes a button. Every connector is read-only by construction — none can be given a scope that changes anything in your account, every credential is verified before it is stored, and none is ever returned to the app.
| Connector | What it files as evidence |
|---|---|
| Google Workspace | The access review an auditor asks for first: every account and its 2-step verification status |
| Microsoft 365 | Entra ID accounts and how they authenticate |
| Okta | User directory, lifecycle state and MFA factors |
| GitHub | Who is in your organization, who owns it, and whether code review is enforced |
| GitLab | Group membership, access levels and protected branches |
| AWS | Root MFA, IAM users and who is missing a second factor |
| Cloudflare | Account members, their roles and whether they use two-factor |
| Vercel | Who can deploy, and what is deployed |
| Supabase | Your project inventory and who can reach it |
| Slack | Who is in the workspace, who administers it, and guest accounts |
| Linear | Who has access to your issue tracker, and who is an admin |
| Jira | Who can see your issues, including customers and app accounts |
Each sync files a dated, readable snapshot against the requirement it proves, and tells you in the inbox when it has done so. Starter includes 2 connectors, Pro includes 10.
Tasks and reminders
Title, description, priority, due date, an owner and additional assignees, and a status of todo, in progress, blocked or done — each linked to the requirement it advances.
Quarterly access reviews, annual policy reviews. Complete one and the next is scheduled automatically at the interval you set.
Tasks due and overdue, evidence up for review or expired, policies due for review, a task newly assigned to you, an integration that has synced, a trial about to end.
Everything lands in an in-app notification inbox with read state. Push notifications are optional — the inbox works exactly the same without them.
Team
| Role | Can do |
|---|---|
| Owner | Everything, including billing and transferring the company |
| Admin | Manage compliance data, the team and billing |
| Member | Complete tasks and upload evidence |
| Viewer | Read only — and read-only in Postgres, not merely in the UI |
Invite by email address, change a role, remove a member. An invitation appears for the invitee under More once they sign up with that address — invitations are not emailed out yet.
Who did what, to what, and when — across policies, evidence, tasks, requirements and team changes. The table has no update or delete policy at all, so the history cannot be edited after the fact, including by you.
The current plan, what it includes, what you have used against each limit, and the trial end date. Payment runs server-side through a merchant of record; the app never handles card details.
The audit pack
One export, generated server-side, covering the whole workspace:
Every requirement by category, with its status, its controls, and the evidence filed against it with dates and expiry.
The register — status, version, approval date and next review date — followed by the full text of each policy.
Every file, the requirement it proves, its status, when it was filed and when it expires.
Status, priority, due date and recurrence, so the operating cadence is visible rather than asserted.
The dated record of the work, straight from the append-only log.
Share it from the app, open it anywhere, print it to PDF. No proprietary format and no viewer to install.
Security
Every company-owned table enforces tenant isolation with row-level security keyed on company membership — not in application code, where a bug becomes a breach.
A private bucket partitioned by company, five-minute signed download links, and an access log the client can read but not write.
Integration secrets live in a table with no row-level security policies at all, which means the application's own database role cannot read it under any circumstances.
The activity log and policy version history have no client write path. What happened stays what happened.
Subscriptions have no client write policy. Only the signature-verified payment webhook can move billing state.
No payment, AI or provider credential is ever present in the shipped app bundle. Plan limits are enforced by database triggers, so a patched client gains nothing.
Where it runs
The same product, the same data, the same permissions. Do the assessment on a laptop where typing is easier, photograph a signed document on your phone on the way to a meeting, and both people see it immediately.
Nothing to install. Open it and you are in the assessment — every screen, every export.
The native app adds the camera for evidence and push notifications that chase overdue work.
Your company, your team and your evidence are the same on both. Sign in anywhere; the readiness estimate is the same number.
Push notifications are the one thing the browser does not do — reminders still arrive in the in-app inbox, which is where they live on every platform.
An honest list, so nothing is a surprise after you have paid.
Fourteen days, no card required. The full assessment, all 29 requirements and your readiness estimate — before the first coffee goes cold.