Pro tour
Run the program
Evidence that arrives on a schedule, tests with a sample anybody can re-derive, policies people have actually read and leadership signed off, findings with a deadline, a scan for personal data before an auditor finds it, and privacy requests answered on time.
Evidence requests
A requirement is a standing instruction against one or more controls. Each period becomes its own record: opened before it is due, chased, escalated when nobody answers, and kept, including the periods that came back late or not at all.
That is the answer to the assessor who asks for the evidence from every period of the window. The coverage view lays a control's periods side by side, so the missed one is the first thing you see.
Control testing
A testing period is a window and a framework. Generate the test list from SOC 2 (the Pro pack carries 61 criteria and 305 test procedures), name a tester and a reviewer, and record the result. A tester cannot sign off their own test, and neither can an administrator.
Samples come from a population that is frozen with a SHA-256 the first time you draw from it. The seed is stored, so anybody can re-derive the same rows, and one button checks that the seed still gives the stored rows and the population still hashes to the stored digest.
The observation window report lists evidence dated outside the period and controls never tested in it, so a policy from before the window cannot pass a test inside it.
Policy acknowledgement and training
A campaign pins each policy at the version in force and records every confirmation with that version and the digest of the exact file. Reissue a policy and everybody is asked again, while last year's confirmations stay exactly as they were.
Security-awareness courses and attestations sit beside it on the same screen.
Policy approvals
Put an approval chain on the folder that holds your policies: ordered steps, a step that needs two of three people, or steps that open together. Each person decides once, and nobody approves a version they uploaded.
Every decision is kept with the digest of the exact file. The last one files a signed record as evidence, and a renewal opens before the next review.
Remediation
Import a scanner export, map the columns you want, and each finding gets a deadline by severity. A finding is fixed only when a later full scan no longer lists it: nobody can mark one fixed by hand, and neither can a ticket moving to Done.
A risk can be accepted for up to a year, with a reason, and the finding reopens when the acceptance ends.
Personal data
Every upload is scanned for card numbers, national identifiers, keys and other personal data, by detectors that run on your own server. A finding is a warning: the original file is never modified, and the examples kept are masked.
When a file has to go to an auditor, a masked copy hides what was found.
Privacy requests
Access, deletion and correction requests, with the deadline worked out for the GDPR, the UK GDPR, the CCPA, PIPEDA and Quebec's Law 25, counted with your own holidays. A request can arrive through a public form you switch on, and the reply is drafted from your own wording.
The requester's details are encrypted, and removed a set time after the request closes, leaving the dates and the outcome for the register.
People and devices
Everything here is a comparison of files you export. Conformiti never switches an account off and never contacts a device.
People and access
Import your people and the accounts in the systems you use. Conformiti tests whether everyone who left lost access inside the limit you set (one day by default), lists the removals it cannot prove, and lists active accounts that belong to nobody. Each test is a record you can export and file as evidence.
Access reviews run a campaign over the newest list of each system. Reviewers come from an owner column, a department or a named fallback. Every account gets a keep, change or revoke decision that can never be edited, and the completion report checks each revoke against the next list.
Personnel compliance
One row for every person in scope: their policies, their training, their device and their background check, each due from the day they started or joined the list. Windows can differ by department, and reminders are a switch.
An exemption is a record with a reason and an end date, and the report is filed once as evidence.
Devices and vendor discovery
Import an export from your device management tool. Conformiti shows the devices that are not encrypted, have no screen lock, are not managed, have not checked in for too long, have no owner, or belong to someone who has left. The report downloads as a CSV and files as evidence once.
The Discovery tab lists the systems in your account imports that are missing from the vendor register, so somebody can add the vendor or say it is not one.
Library
Content you install when you want it, built from the same controls everything else in the product already uses.
Coverage atlas
The dashboard draws one square for every control, grouped by framework. Point at one and every control that answers the same theme in any installed framework lights up. Pin it, and the card names the themes and lists the partners.
Every control in every library sits in at least one shared theme, so the atlas has no dead squares: a control written for one framework tells you where else its evidence counts. A library installed on its own links all of its own controls, and with all of them installed each control has a partner in another framework.
Packs
Packs become ordinary controls in your library, so evidence links, readiness scoring and audit packages work on them like on any other control. A licence covers every library, and you switch on the ones that apply to your organisation: only those add controls to your readiness figure and to the coverage atlas.
A set comes out again whole, and only while nothing has been done in it. Once a control has a status, an owner, evidence or a test, the set stays and the screen lists what is keeping it. The policy and register seed pack files documents in your name, so it installs only when you ask. A document already installed is never overwritten, and a refresh files a new version.
New in 1.6.5: UK Cyber Essentials, the Australian Essential Eight and the EU Cyber Resilience Act joined the libraries, which makes 27, and the registers gained a Risk Scenario Library of 120 starting scenarios that import into the risk register.
Custom frameworks
Define the controls your organisation is held to, such as a house standard, a regulator's letter or a client's contractual schedule, and crosswalk them to the shipped libraries.
They behave exactly like a shipped framework: evidence links, readiness scoring, the responsibility matrix and audit packages all work on them.
Questionnaires
Upload the file the prospect sent. Conformiti reads the questions and drafts an answer to each one from your controls, your evidence and answers you approved before, with the sources beside every draft.
A person approves every answer, and only approved answers go back into the file. Where the facts do not support an answer, the draft says so and says why, instead of guessing.
Clients and the board
A public page for prospects and a scheduled pack for the board, both built from the live program.
Trust centre
Publish the reports you hold with their validity windows, the subprocessors you choose to disclose, how you handle data and a security contact. Framework badges, a readiness band and monthly availability figures are switches you set. The page is curated: it never carries control-level detail, document names, owner names or the risk register. A visitor who asks for your SOC 2 report ends up with real access rather than an email into a void.
New in 1.6.5, a daily chart of page views and the request funnel from views to approvals. It counts and nothing more: no address, no browser and no cookie.
Answers on the trust centre
The answer comes from the answers you approved, or from your page's own words through your model key. A reply is shown only when its figures, its addresses and most of its words are on the page. Otherwise the visitor is pointed to a request.
Every question is listed with how it was answered, so the ones the page does not cover become your next approved answers.
Board reports
A template builds a quarterly pack for a board or steering committee as one self-contained HTML document laid out for A4. Open it and use the browser's print command to keep a PDF copy.
The figures are frozen when the pack is made and, where the program has been measured, taken as at the close of the period being reported.
Assurance
A vendor's SOC 2 report becomes the controls it leaves to you, and your NIST program becomes a system security plan.
Assurance report reader
Upload a vendor's SOC 2 report, ISO certificate or penetration test summary. Before anything is sent, the screen names the pages and the characters that will go to your model. It proposes the period, the opinion, the exceptions and the controls left to you, each with the passage it came from, and nothing is written until a person confirms it.
The controls left to you become a list with owners and statuses, each mapped to a control of your own program, and the responsibility matrix records them as shared.
OSCAL system security plan
Your NIST SP 800-53 or FedRAMP Moderate program as an OSCAL 1.1.3 system security plan in JSON, with the value you set for each parameter and how the system meets each control.
The plan says what it holds and what to look at before you send it. A control that does not map is named, never guessed.
Connect
Three doors, each closed until the operator opens it, and each one narrow.
Webhooks
Add an https endpoint, choose its events, and every matching event is posted to it as signed JSON, retried with backoff, logged for 90 days and replayable. The secret is shown once.
It sends only to hosts the operator has named. Never over http, never to a private address and never through a redirect, and the check runs again at every delivery.
Push connections
A nightly access check, a CI step or an infrastructure test calls Conformiti with a token and says this control passed or failed, what was checked, and when. Conformiti never connects out: the job calls in.
A result never marks a control implemented, and a connection that stops reporting is shown as silent, never as clear.
AI assistants
A person makes a personal token and gives it to an assistant that runs on their own machine. The assistant can then read what that person can see: what is overdue, which controls have no evidence, which vendors are due for review. It cannot change anything, and every call is listed under Recent activity.
The feature is off until the operator turns it on.
Conformy
Bring your own key, or your own model. Nothing leaves your server except the call you configured.
Conformy
Questions are answered from the controls, documents, risks and vendors you can already see, and each answer lists what it was based on. Conformy can explain a gap, propose which controls a document could serve as evidence for, and draft a policy from your own control objectives.
What it drafts lands in Drafts as a proposal. Nothing is written to the program until a person accepts it, and the audit trail names the person.
It runs on your own key, called from your own server, or on a model server you run. Conformiti never proxies your evidence and never ships a key.
More in Pro
Notes and the meeting scheduler, two features that need an account of your own before they have anything to show, and the assistant panel.
Notes
Notes for yourself or for the whole workspace, linked to a control or a vendor. Type @ to tag a colleague: the note appears in their notifications, and can be emailed to them as well.
A note is private until you share it, and the author's name and the time are kept.
Meeting scheduler
Conformiti creates the invites from your own Microsoft or Google application, with a Teams or Meet link, and keeps a refresh token on your server, encrypted at rest. No client id or secret ships with the product, and nothing is proxied through us.
Until a calendar is connected the cadence is tracked and nothing is booked, which is the state in this picture.
Send a policy for signature through DocuSign or Dropbox Sign, or track a manual signing. The executed copy and its certificate are filed back onto the same document as a new version. It needs your own signing account before it has anything to show, so it is described here rather than pictured.
Read a signed contract with your AI provider. It proposes the vendor record, the standards the counterparty is held to and the expiry date, and nothing is written until you confirm what it read. It needs your own provider, so it is described here rather than pictured.
An assistant on every page. Ask about the control or vendor on screen, or about the whole program, and the answer comes from your own records, with links to the ones it used. It reads only what you can open and changes nothing. It is sold separately, needs Conformy, and runs on your own model key, so it is described here rather than pictured.
Enterprise
Enterprise is the next edition up. Three of its screens, so you can see the difference. The Enterprise tour has the rest.
Business units
For a company that owns several software suites or business units. Each unit keeps its own workspace and its own frameworks; the group holds every unit to one baseline of crosswalk themes and reads them with one measure of readiness, the core's own score. A theme is met only when the unit's weakest control in it is, and a critical theme that is not met puts the unit under the floor, whatever its score. Nothing is averaged.
The group sees bands, scores and counts, and never a document, person or vendor. Each unit sees what the group requires of it, and who at the group has read it.
Vendor risk
Enterprise adds vendor risk scoring, concentration (a category served by one critical provider, providers per country, fourth parties shared by several vendors) and a DORA register of information export. It also adds Group readiness across every unit and client you reach, a client portfolio for consultancies, white-label branding, and time-boxed engagements for an external auditor. Pro is complete without them.
The comparison, line by line, is on the editions page.
Next
A call is thirty minutes and we drive. The install guide shows what Pro changes in your checkout before you commit to anything.