Platform / For auditors and regulators
For auditors, regulators and second-line risk
Every number on this platform can be walked back to the record that produced it.
Most security reporting fails an audit in the same place: the figure is real, and nothing behind it can be reconstructed six months later. This platform was built the other way round — the evidence is the primary artifact and the report is a view over it.
The four properties an auditor actually needs
Claims carry citations
A sentence in a report links to the record proving it. No uncited claim ships — that is a construction rule, not a review step someone can skip under deadline.
Records are tamper-evident
Events are fingerprinted at collection. Later alteration is detectable — including alteration by us, which is the only version of that property worth anything to you.
Decisions name their author
Every action that changed the estate records which check allowed it, which held it, and which named person released it. Approval by the requester is structurally impossible.
Gaps are stated, not smoothed
Where something was never measured, the report says so instead of returning a zero. A stated gap is auditable; a confident average over unmeasured machines is not.
What an evidence pack contains
Exportable for someone with no access to the console — because an auditor should never need a licence to read what they are auditing.
The narrative
What happened, in plain sentences, each carrying its own citation. Written to be read by someone who was not there.
The underlying events
The sealed records themselves, with both timestamps intact — when it happened on the machine, and when it was first seen.
The decision trail
Every action taken, which guard held or allowed it, who released it, and how long that took. Including the actions that were refused.
The coverage statement
Which machines this evidence covers and which it does not — as counts, never as a percentage that averages away the unmeasured.
The integrity proof
Fingerprints allowing an independent party to confirm nothing in the pack was altered after collection.
What is deliberately absent
No scores, no maturity ratings, no letter grades. Those are opinions, and an evidence pack that mixes them with facts devalues the facts.
Data residency and who can read what
It runs where you run it
The platform is self-hosted. Your events are on your disks, in your jurisdiction, and the licence does not require them to leave — an expired licence stops forward motion rather than reaching for your data.
This is the shortest answer to a residency question that most vendors answer with an architecture diagram and a list of regions.
This is the shortest answer to a residency question that most vendors answer with an architecture diagram and a list of regions.
Need-to-know is enforced, not requested
Sensitive material can be placed in compartments only named holders may read, with a request path a second person approves. Elevated access is time-bounded and recorded rather than granted permanently and quietly.
An access review here reads from what was enforced, not from what somebody intended.
An access review here reads from what was enforced, not from what somebody intended.
A commercial lapse cannot suspend a statutory obligation
Worth knowing for a certification conversation, because it is the kind of thing that only surfaces at the worst moment. If a licence lapses, two planes do not degrade at all. Enforcement continues — detection, blocking, the approval gate and every response action — and so does the obligation plane: consent, erasure, grievance and privacy handling, the audit record, the bill, and the ability to log in and read why. A data subject's rights are owed to that person, who is not a party to our contract and cannot cure a lapse in it.
What does stop, after a grace window, is forward motion: authoring new policy and detectors, the reporting surfaces, feed freshness and support entitlement. Read-only truth stays. The pricing page publishes the full ladder.
What does stop, after a grace window, is forward motion: authoring new policy and detectors, the reporting surfaces, feed freshness and support entitlement. Read-only truth stays. The pricing page publishes the full ladder.
The honest limits
Published on every page of this site. You will want these before a certification conversation, not after.
We hold no certifications yet
No SOC 2, no ISO 27001 as a vendor. We are early, and claiming otherwise is the one thing that would end this conversation permanently. What we can give you is the platform's own evidence properties and a direct line to the people who built them.
Tamper-evidence is not tamper-proofing
We can prove a record changed. We cannot prevent someone with sufficient access to your infrastructure from destroying it — and a vendor who tells you otherwise about your own hardware is selling you something.
Evidence stops at your retention window
A question reaching past it has no answer here. Legal hold exists precisely so an investigation can outlive the ordinary window, and it has to be applied before the window closes.
A machine without the agent is invisible
Coverage is enforcement, and enforcement happens where the agent runs. An estate is never reported as compliant on the strength of the machines that happened to be instrumented.
Read the vocabulary before the evidence.
The distinctions this platform makes — withheld against unfiltered, unmeasured against zero, a hold against a refusal — are exactly the ones an audit turns on. The glossary defines each the way the product behaves.