Website security evidence your auditor can use
Our scans check your certificates, headers, TLS, DNS, email security and exposed software on a schedule. Each check is mapped to the controls it gives evidence for in these 6 frameworks.
Evidence, not a certificate
We cover the technical controls that can be checked from outside your site. Policies, access reviews and the rest of the audit are still yours.
A year of history
Scheduled scans show the control stayed in place all year, with every lapse dated and explained from that day’s scan.
What the scan saw
Each control shows the raw headers, certificate or DNS records behind it. Export as PDF, CSV or an image.
What we check
2017 TSC · 6 controls
Trust Services Criteria for SOC 2 reports. Our checks cover the parts an outside scan can see: encryption in transit, system boundaries, vulnerability detection, change management and availability.
2022 · 8 controls
Annex A controls from ISO/IEC 27001:2022. Our checks cover cryptography, information transfer, configuration, network security, redundancy and technical vulnerabilities.
4.0 · 9 controls
Requirements from PCI DSS v4.0 for systems in or connected to the cardholder data environment, including strong cryptography over public networks, phishing protection, web attack prevention, payment page scripts and patching.
v11.3 · 7 controls
HITRUST CSF control references, common in healthcare. Our checks cover cryptography and key management, network controls, information exchange, input validation and technical vulnerabilities.
2.0 · 7 controls
Outcomes from the NIST Cybersecurity Framework 2.0, mainly Protect (data in transit, platform security, network resilience) and Identify (vulnerabilities in assets).
Rev. 5 · 13 controls
Security controls from NIST SP 800-53 Rev. 5, used by US federal systems and FedRAMP: system and communications protection, DNS security, vulnerability scanning, flaw remediation and unsupported components.
dashed shown for information; it does not decide the control.
No. Those come from an audit of your whole organization: policies, access reviews, vendors, HR, and much more. We cover the technical controls that can be checked from outside your website, and give you dated evidence for them. Your auditor decides whether a control is met.
For each control: the rule we check, exactly what the scan saw (the response headers, certificate, DNS records), and a day-by-day history for the last year with every lapse explained. You export it as a PDF, a CSV for spreadsheets or GRC tools, or an image of a single control.
Every monitored domain is scanned on its schedule, and each scan is kept, so the history shows whether a control stayed in place all year, not just on the day someone took a screenshot.
HSTS is good practice, but no framework we map to requires it by name, so a missing header is shown in the evidence without failing the control.
Yes. Scan any domain free on the homepage to see its security checks. The compliance evidence view, history and exports are part of the paid plans.
Pro and Enterprise
Hand your auditor a year of proof.
Control-by-control evidence for every domain you monitor, with daily history and PDF, CSV and image exports.