Product · Compliance leads, internal audit and external auditors.
Every change in an audit window, with its work item, approvals, evidence, deploy and verification, including the changes drift detection found. Signed, so an auditor can verify it offline.
- The problem
- Audit evidence is screenshots, gathered by hand, sampled, and impossible to prove complete.
- What it does
- Produces the complete change population for any window from the records, maps it to each framework clause, and opens a portal for your auditor that ends when the audit closes.
- The result
- Audit prep is an export, not a project, and the auditor can verify integrity without trusting us or you.
SOC 2 Type II · 1 Jan to 30 Sep 2026
Auditor access until 31 DecEvery production change in the window, with its work item, approvals, evidence, deploy and verification.
- CHG-2291Partial refunds2 peopleWorking, v4.18.0
- CHG-2290Pricing page copyPolicy standard-copy-v3Working
- CHG-2288Hotfix: webhook retriesJ. Osei, 3 h after deployReviewed after, within 24 h
- DRF-031Manual deploy, payments-apiRolled backResolved, rollback attached
- CHG-2285Dependency bump, minorPolicy deps-minor-v2Working
- DRF-029kubectl set image, ledgerApproved as emergency CHG-2281Resolved, retro approval
Showing a sample. Drift items are listed with how each was resolved, never hidden. Each row links to its signed change record.
The auditor portal
Access opens with the observation window, is limited to the frameworks in scope, and ends when the audit closes. You can preview what the auditor sees.
- Evidence requests tied to controls, one thread per request.
- Scope changes during the window are recorded and shown to the auditor.
Integrity you can check
The audit chain is append-only, hash-chained and signed hourly, the same pattern as AWS CloudTrail digests. Exports carry RFC 3161 timestamps and sit in write-once storage.
- A published verification method, so an auditor needs no Aspian access.
- Audit log streaming to S3, Splunk and Datadog.
We feed your compliance tool
Vanta and Drata check pull requests. We push the deploy-level evidence they can’t see, so they keep working and get better.
Read next
See what shipped without approval in your last 90 days.
Install the GitHub App and the scan arrives in minutes: every repo scored, every unreviewed merge and unapproved deploy named. Nothing is blocked until you choose.
Ship like a startup. Prove it like a bank.