Assurance on file
SOC 2 reports, ISO certificates, AOCs and DPAs, each with an expiry that drives the rating.
A crosswalk underneath
Twenty themes tie the libraries together, so one policy can answer CC6.1, A.5.15 and 7.1.
Product tour
Every screen, and what
you actually do on it.
The shipping build on the demo dataset. Click any image to enlarge it.
01 · Frameworks and controls
The register everything else hangs off.
SOC 2 (61), ISO/IEC 27001:2022 (93) and PCI DSS v4.0.1 (63), loaded on first boot. Each control has an objective, a status, an owner and its evidence.
Readiness is arithmetic. Implemented ÷ applicable, per framework. Marking a control not applicable is recorded in the audit trail.
Links go both ways
Map evidence from the control or the document. It is the same link either way.
Owners are real accounts
A person with a login, not a text field, so reminders reach someone.
02 · Documents and evidence
A folder tree generated from the standards.
Framework, then category, then control, with your own subfolders wherever you want them.
Lifecycle
Versions, not overwrites
Old versions stay retrievable for when the auditor asks what the policy said last spring.
Reminders
The clock that runs itself
Owners are emailed at 30, 14, 7 and 1 days out, and once when a review is overdue.
Access
Grants that inherit
View, edit or manage per folder, by role or person, inherited downward. Auditors are capped at view.
Open in browser
Review evidence without downloading it.
- PDFs drawn by pdf.js, with no scripting from the file
- Images shown only after a check of the actual bytes
- Word and Excel parsed on the server and rendered as structure, never as the file's own markup
03 · Dashboard and analytics
Numbers with a provenance.
Readiness is snapshotted daily, so the trend you show the board can be reproduced.
Lead schedule
One row per framework, from applicable controls to evidence linked and readiness.
Coverage atlas
One square per control. Point at one and its crosswalk partners light up in every framework.
Notification tray
What is due for you, with an optional daily or weekly digest.
04 · Risk register
Five by five, with a paper trail.
Likelihood × impact, treatment, owner, due date and a note trail on every risk.
- Imports CSV and XLSX, including word scales like Likely and Almost certain
- Skips duplicates instead of creating a second copy
- An auditor's exception lands in the register in one click
05 · Access reviews and the audit trail
Two screens that answer most of the questions.
Access reviews
Every account is snapshotted, so the grid cannot shift under you. A finished review is read-only evidence.
Audit trail
Field names, never values. There is no API to edit or delete an entry.
06 · Vendors and shared responsibility
Third-party risk, computed rather than asserted.
The matrix importer
Reads a vendor's matrix in whatever shape it arrives. Nothing is saved until you confirm.
The questionnaire, sent out
A personal, expiring link. The vendor answers without an account and you accept or reject.
One Accountable per control, enforced by the API. Controls with none are counted.
07 · Audit packages
The feature the rest of
the product exists to feed.
Sealed, signed, issued to named auditors for a fixed window, and verified offline without us.
What sealing does
- Snapshots every control and file, with its SHA-256, into one manifest
- Signs it with Ed25519, using a key kept outside the database
- Freezes the package. A file swapped later is named at export: the seal detects a substitution, it does not prevent one
What the auditor gets
- Access to the pinned files and the request-list answers, and nothing else
- Design and operating conclusions the API will not let you edit
- A ZIP that verifies itself with a stdlib-only
verify.py
Sampling
You state the population. The auditor records a verdict per item.
Roll-forward
Next year's package from this year's, with what changed in between.
PBC request list
Each request assigned, dated and chased until answered.
What the auditor runs, on their own machine
$ unzip conformiti-package-fy26-soc2.zip && cd conformiti-package-fy26-soc2 $ sha256sum -c SHA256SUMS evidence/access-control-policy-v4.pdf: OK evidence/user-access-review-2026-Q1.csv: OK … $ python3 verify.py manifest digest d41f0e…9ab2 OK signature Ed25519 OK (key 8c:1a:…:e7) files 214/214 OK # no network, no dependencies, no vendor involvement
08 · The rest of the governance calendar
Meetings, groups and the ticket board.
Proof the program is run by people, on a cadence, with minutes.
Meetings
A required cadence per series, and a badge that knows what is due so far this year.
Champion groups
Who speaks for which part of the business, with one accountable owner.
Jira optional
Read-only boards for everyone, without a Jira seat. The token never reaches the browser.
09 · Identity, roles and settings
Five roles, folder grants,
and an API that means it.
The API enforces every capability. A hidden button is never the security model.
- TOTP and passkeys, with backup codes. A possibly cloned key is disabled and the sign-in refused.
- OIDC and SAML 2.0, configured from the environment only, with step-up MFA when the provider asserted none.
- No self-lockout, and never an organisation without an active administrator.
| Role | Manage users | Manage frameworks | Manage documents | Manage folders | View all | Auditor |
|---|---|---|---|---|---|---|
| Administrator | ✓ | ✓ | ✓ | ✓ | ✓ | No |
| Compliance Manager | No | ✓ | ✓ | ✓ | ✓ | No |
| Control Owner | No | No | granted folders | No | No | No |
| Auditor | No | No | No | No | registers read-only; documents by grant | ✓ |
| Viewer | No | No | No | No | No | No |
Custom roles use the same flags. Auditor roles are always capped at view.
10 · Workspaces
One installation, several organisations.
Every organisation-owned row belongs to a workspace, and the filter is applied in the data layer, so a view that forgets to scope still cannot leak.
- Archive a workspace and its people are signed out. Nothing is deleted.
- Each workspace gets its own reminders, mailbox and Slack or Teams channel.
- An existing install becomes one workspace called Default and never notices.
Who this is for
| MSPs and consultancies | Each client's program on one deployment. Enterprise adds one console across all of them. |
|---|---|
| Groups | Several regulated entities, with separate scopes and auditors. |
| Separate certifications | A PCI subsidiary kept apart from the group's ISO program. |
Single sign-on and the signing key are installation-wide. Passkeys and second factors belong to the person.
Editions
Everything above is
the free build.
Every screen on this page ships in Core, AGPL-3.0 licensed, with nothing switched off.
Pro
The Conformy assistant, control testing, a trust centre and 27 compliance packs.
Enterprise
Everything in Pro, plus one console for every client.
Gallery
Every screen, in one place.
Shown in Ledger Dark, one of four theme packs.
See it with your own data
Install it and load the demo dataset, or book thirty minutes and we will drive.
Next
Read the code, or run it.
Both take about a minute, and nothing stands between you and either.