Get access

SPEC 00 · continuous compliance

Audit season is a bug.

Steady compliance evidence, even when audits come rushing.

Eddystone reads AWS, GitHub and Okta around the clock, files every piece of evidence against SOC 2, ISO 27001 and HIPAA, and gives your auditor a read-only link instead of a folder of exports.

Get access See pricing
status: steady

FIG. 00 · on the roster

Security and IT teams at these companies retired the evidence spreadsheet and kept the weekends.

  • Dunmore
  • Hollowell
  • nightjar
  • Fallowfield
  • Greystone

SPEC 01 · features

The evidence folder that files itself.

Five things Eddystone does while your team ships product, each one a line your auditor would otherwise have asked you to prove by hand.

FIG. 01 · evidence-sources

Evidence that files itself

Collectors read AWS, GitHub, Okta and Jira on a schedule: IAM credential reports, branch rules, MFA policies, ticket histories. Every item is timestamped and stored against the control it proves, so nobody goes hunting in March for something from August.

FIG. 02 · drift-detail

Drift alerts with a name attached

Controls are re-tested continuously, not once a quarter. When an Okta policy loosens or a bucket opens up, the owner gets the control, the diff and the person who changed it in Teams or Jira, while the fix is still a five-minute job.

FIG. 03 · cross-map

Collect once, answer three frameworks

One MFA policy export satisfies SOC 2 CC6.1, ISO 27001 A.8.5 and HIPAA 164.312(d). Eddystone maps evidence across frameworks, so adding ISO next year is a toggle, not a restart.

FIG. 04 · auditor-view

A read-only room for your auditor

Invite your auditor to a scoped portal where they can see requests, evidence and status, and comment on the exact item. Nothing to email, nothing to zip, and nothing they can change.

FIG. 05 · access-review

Access reviews in one click

Every account and entitlement from Okta, AWS and GitHub lands in one review. Reviewers keep or revoke per person, then certify. The signed review files itself as evidence for the next audit.

SPEC 02 · setup flow

Plug it in once. The filing never stops.

01

Connect

Authorise AWS, GitHub and Okta with read-only scopes. Collectors start pulling configs, logs and access lists straight away.

read-only scopes
02

Map

Pick SOC 2, ISO 27001 or HIPAA. Each piece of evidence is tied to every control it satisfies, so you collect once and reuse it.

one item, many controls
03

Watch

Controls are re-tested continuously. Drift alerts reach the owner in Teams or Jira before an auditor ever spots the gap.

drift to owner, fast
04

Hand over

Invite your auditor to the read-only portal. They track requests, pull evidence and comment in place. You export nothing.

auditor-only view

SPEC 03 · works with

Works with your favorite tools

Native collectors cover AWS, GitHub and Okta. Everything else on this strip routes tickets, alerts and records into the same evidence trail.

  • Jira
  • Xero
  • Notion
  • Zapier
  • Shopify
  • Asana
  • Airtable
  • Microsoft Teams

SPEC 04 · plans, billed annually

Pick the size of your audit.

Three annual plans. Start with the framework you owe someone this year, and move up when the list of frameworks, vendors or auditors grows.

Plan 01

Anchor

$209/yr

billed annually

  • SOC 2 framework template
  • 15 integrations
  • Automated evidence collection
  • Email support
Get Anchor
Plan 02

Bulwark

$339/yr

billed annually

  • Up to 4 frameworks
  • 60+ integrations
  • Vendor risk tracking
  • Auditor portal access
Get Bulwark
Plan 03Most picked

Citadel

$589/yr

billed annually

  • Unlimited frameworks
  • SSO and SCIM provisioning
  • Custom control library
  • Dedicated compliance manager
Get Citadel

SPEC 05 · field notes

Heard from the people holding the clipboard.

“Our auditor stopped asking for exports in week one. They live in the read-only portal now, and I only hear from them when a request needs a human.”
— Nadia F., Head of Security, Nightjar
“Drift alerts land in our Teams channel with the failing control and the person who changed it. We closed a public bucket in minutes, not at quarter end.”
— Owen B., VP Engineering, Fallowfield
“Quarterly access reviews went from a week of spreadsheets to one-click certify.”
— Rosa M., IT Manager, Greystone
Collect once

Reuse it across SOC 2, ISO 27001 and HIPAA.

Ready when your next auditor is

Make audit week the dullest week of the quarter.

Connect your stack and let Eddystone keep the evidence folder current while you ship. Your auditor gets a link; you get your Fridays back.

Get access