When every change has to survive an auditor.
Audit prep is expensive because evidence is reconstructed after the fact — screenshots, exports, and a quarter of chasing owners. When every change already passes through a machine-legible chokepoint, the evidence is a byproduct: content-addressed, reproducible, and mapped to the control it satisfies.
Evidence gathered after the fact is the expensive kind.
Not because collecting it is hard, but because it has to be collected at all.
The evidence request list exists because the systems of record were never asked to emit proof as they went. So once a year somebody reconstructs it: screenshots of settings, exports of tickets, and a spreadsheet mapping artifacts to controls.
Sampling exists for the same reason. Testing every item by hand is infeasible, so twenty-five of a population of sixteen hundred stand in for the rest. Both costs are downstream of one decision — whether the platform emits evidence as a byproduct of doing the work, or doesn't.
The evidence already passes through something.
Each machine-legible seam a change flows through can emit an immutable record, mapped to the control it satisfies.
Where evidence comes from
- The hermetic build: what was built, from which inputs, reproducibly — the supporting artifact for change-management controls.
- The merge gate: whether the change was actually exercised before it landed, and the record that it wasn't when it wasn't.
- The forge: a native Check Run attributed to the signed-in user, so approval and authorship are the forge's own record rather than a claim about it.
- The content-addressed depot: history named by BLAKE3 hash, so an attestation about a commit stays true about that commit.
What's satisfied, what isn't, and what's simply absent.
An absent collector reports NO EVIDENCE, which is a different answer from a pass. Values illustrative.
| criterion | control | evidence | state |
|---|---|---|---|
| CC8.1 | Change management | build + gate records | SATISFIED |
| CC6.1 | Logical access | federated token issuance | SATISFIED |
| CC5.2 | Segregation of duties | approval attribution | PARTIAL |
| CC7.2 | Monitoring | — | NO EVIDENCE |
A stronger opinion, not a bigger sample.
The alternative automates the chasing. This removes the thing being chased.
A gap shows as a gap — never a fabricated green. An absent collector is a different answer from a passing control.
Backed by shipping plugins.
Each claim on this page is anchored to a plugin that provides it. The site build resolves these cross-references against the live feature catalog and fails if one of them doesn't exist — so this list can't quietly outlive what the platform ships.
Maps 17 SOC 2 controls to the Trust Services Criteria over a content-addressed, write-once evidence store, generates a point-in-time audit package on demand, and shows a gap as a gap rather than a fabricated green.
plugin detail →Every verdict lands as a native Check Run attributed to the signed-in user, so the forge's own record — not a side-channel log — is the attribution trail.
plugin detail →assess_merge is the artifact showing a change was actually exercised before it merged, rather than passing a build that reached nothing.
plugin detail →Every object is named by its BLAKE3 content hash, so history can't be quietly rewritten underneath an attestation.
plugin detail →Hermetic remote execution stands behind each green, so a control's supporting evidence is reproducible rather than a one-time observation.
plugin detail →1 of the 5 plugins behind this page is in preview: Compliance. Preview means the contracts exist and the surface is being built — not that it ships today.
Adjacent problems.
If the source is the asset, then every tool that touches it is a disclosure decision — including the ones you turned on to go faster.
Read more →Some estates can't send their build plane to a vendor. The whole platform launches into your own AWS account instead.
Read more →Prove it's safe to merge.
Hosted, or launched into your own AWS account. Start free — no card required.