Pro tour
Pictures from the 1.8.0 build, on a made-up company called Blackbox. Click any picture to enlarge it.
These are pictures, not a clickable mock-up. To see it move, book a call and we will drive.
Run the programme
Evidence that arrives on a schedule, tests with a sample anybody can re-derive, policies people have actually read, findings with a deadline, and a scan for personal data before an auditor finds it.
Evidence requests
A requirement is a standing instruction against one or more controls. Each period becomes its own record: opened before it is due, chased, escalated when nobody answers, and kept, including the periods that came back late or not at all.
That is the answer to the assessor who asks for the evidence from every period of the window. The coverage view lays a control's periods side by side, so the missed one is the first thing you see.
Control testing
A testing period is a window and a framework. Generate the test list from SOC 2 (the Pro pack carries 61 criteria and 305 test procedures), name a tester and a reviewer, and record the result. A tester cannot sign off their own test, and neither can an administrator.
Samples come from a population that is frozen with a SHA-256 the first time you draw from it. The seed is stored, so anybody can re-derive the same rows, and one button checks that the seed still gives the stored rows and the population still hashes to the stored digest.
The observation window report lists evidence dated outside the period and controls never tested in it, so a policy from before the window cannot pass a test inside it.
Policy acknowledgement and training
A campaign pins each policy at the version in force and records every confirmation with that version and the digest of the exact file. Reissue a policy and everybody is asked again, while last year's confirmations stay exactly as they were.
Security-awareness courses and attestations sit beside it on the same screen.
Remediation
Import a scanner export, map the columns you want, and each finding gets a deadline by severity. A finding is fixed only when a later full scan no longer lists it: nobody can mark one fixed by hand, and neither can a ticket moving to Done.
A risk can be accepted for up to a year, with a reason, and the finding reopens when the acceptance ends.
Personal data
Every upload is scanned for card numbers, national identifiers, keys and other personal data, by detectors that run on your own server. A finding is a warning: the original file is never modified, and the examples kept are masked.
When a file has to go to an auditor, a masked copy hides what was found.
People and devices
Everything here is a comparison of files you export. Conformiti never switches an account off and never contacts a device.
People and access
Import your people and the accounts in the systems you use. Conformiti tests whether everyone who left lost access inside the limit you set (one day by default), lists the removals it cannot prove, and lists active accounts that belong to nobody. Each test is a record you can export and file as evidence.
Access reviews run a campaign over the newest list of each system. Reviewers come from an owner column, a department or a named fallback. Every account gets a keep, change or revoke decision that can never be edited, and the completion report checks each revoke against the next list.
Devices and vendor discovery
Import an export from your device management tool. Conformiti shows the devices that are not encrypted, have no screen lock, are not managed, have not checked in for too long, have no owner, or belong to someone who has left. The report downloads as a CSV and files as evidence once.
The Discovery tab lists the systems in your account imports that are missing from the vendor register, so somebody can add the vendor or say it is not one.
Library
Content you install when you want it, built from the same controls everything else in the product already uses.
Coverage atlas
The dashboard draws one square for every control, grouped by framework. Point at one and every control that answers the same theme in any installed framework lights up. Pin it, and the card names the themes and lists the partners.
Every control in every library sits in at least one shared theme, so the atlas has no dead squares: a control written for one framework tells you where else its evidence counts. A library installed on its own links all of its own controls, and with all of them installed each control has a partner in another framework.
Packs
Packs become ordinary controls in your library, so evidence links, readiness scoring and audit packages work on them like on any other control. A licence covers every library, and you switch on the ones that apply to your organisation: only those add controls to your readiness figure and to the coverage atlas.
A set comes out again whole, and only while nothing has been done in it. Once a control has a status, an owner, evidence or a test, the set stays and the screen lists what is keeping it. The policy and register seed pack files documents in your name, so it installs only when you ask. A document already installed is never overwritten, and a refresh files a new version.
New in 1.6.5: UK Cyber Essentials, the Australian Essential Eight and the EU Cyber Resilience Act joined the libraries, which makes 27, and the registers gained a Risk Scenario Library of 120 starting scenarios that import into the risk register.
Custom frameworks
Define the controls your organisation is held to, such as a house standard, a regulator's letter or a customer's contractual schedule, and crosswalk them to the shipped libraries.
They behave exactly like a shipped framework: evidence links, readiness scoring, the responsibility matrix and audit packages all work on them.
Questionnaires
Upload the file the prospect sent. Conformiti reads the questions and drafts an answer to each one from your controls, your evidence and answers you approved before, with the sources beside every draft.
A person approves every answer, and only approved answers go back into the file. Where the facts do not support an answer, the draft says so and says why, instead of guessing.
Customers and the board
A public page for prospects and a scheduled pack for the board, both built from the live programme.
Trust centre
Publish the reports you hold with their validity windows, the subprocessors you choose to disclose, how you handle data and a security contact. Framework badges, a readiness band and monthly availability figures are switches you set. The page is curated: it never carries control-level detail, document names, owner names or the risk register. A visitor who asks for your SOC 2 report ends up with real access rather than an email into a void.
New in 1.6.5, a daily chart of page views and the request funnel from views to approvals. It counts and nothing more: no address, no browser and no cookie.
Board reports
A template builds a quarterly pack for a board or steering committee as one self-contained HTML document laid out for A4. Open it and use the browser's print command to keep a PDF copy.
The figures are frozen when the pack is made and, where the programme has been measured, taken as at the close of the period being reported.
Connect
Three doors, each closed until the operator opens it, and each one narrow.
Webhooks
Add an https endpoint, choose its events, and every matching event is posted to it as signed JSON, retried with backoff, logged for 90 days and replayable. The secret is shown once.
It sends only to hosts the operator has named. Never over http, never to a private address and never through a redirect, and the check runs again at every delivery.
Push connections
A nightly access check, a CI step or an infrastructure test calls Conformiti with a token and says this control passed or failed, what was checked, and when. Conformiti never connects out: the job calls in.
A result never marks a control implemented, and a connection that stops reporting is shown as silent, never as clear.
AI assistants
A person makes a personal token and gives it to an assistant that runs on their own machine. The assistant can then read what that person can see: what is overdue, which controls have no evidence, which vendors are due for review. It cannot change anything, and every call is listed under Recent activity.
The feature is off until the operator turns it on.
Copilot
Bring your own key, or your own model. Nothing leaves your server except the call you configured.
Copilot
Questions are answered from the controls, documents, risks and vendors you can already see, and each answer lists what it was based on. The copilot can explain a gap, propose which controls a document could serve as evidence for, and draft a policy from your own control objectives.
What it drafts lands in Drafts as a proposal. Nothing is written to the programme until a person accepts it, and the audit trail names the person.
It runs on your own key, called from your own server, or on a model server you run. Conformiti never proxies your evidence and never ships a key.
More in Pro
Notes and the meeting scheduler, and two features that need an account of your own before they have anything to show.
Notes
Notes for yourself or for the whole workspace, linked to a control or a vendor. Type @ to tag a colleague: the note appears in their notifications, and can be emailed to them as well.
A note is private until you share it, and the author's name and the time are kept.
Meeting scheduler
Conformiti creates the invites from your own Microsoft or Google application, with a Teams or Meet link, and keeps a refresh token on your server, encrypted at rest. No client id or secret ships with the product, and nothing is proxied through us.
Until a calendar is connected the cadence is tracked and nothing is booked, which is the state in this picture.
Send a policy for signature through DocuSign or Dropbox Sign, or track a manual signing. The executed copy and its certificate are filed back onto the same document as a new version. It needs your own signing account before it has anything to show, so it is described here rather than pictured.
Read a signed contract with your AI provider. It proposes the vendor record, the standards the counterparty is held to and the expiry date, and nothing is written until you confirm what it read. It needs your own provider, so it is described here rather than pictured.
Enterprise
Enterprise is the next edition up. Three of its screens, so you can see the difference. The Enterprise tour has the rest.
Business units
For a company that owns several software suites or business units. Each unit keeps its own workspace and its own frameworks; the group holds every unit to one baseline of crosswalk themes and reads them with one measure of readiness, the core's own score. A theme is met only when the unit's weakest control in it is, and a critical theme that is not met puts the unit under the floor, whatever its score. Nothing is averaged.
The group sees bands, scores and counts, and never a document, person or vendor. Each unit sees what the group requires of it, and who at the group has read it.
Vendor risk
Enterprise adds vendor risk scoring, concentration (a category served by one critical provider, providers per country, fourth parties shared by several vendors) and a DORA register of information export. It also adds a client portfolio for consultancies, white-label branding, and time-boxed engagements for an external auditor. Pro is complete without them.
The comparison, line by line, is on the editions page.
Next
A call is thirty minutes and we drive. The install guide shows what Pro changes in your checkout before you commit to anything.