Agents poll for the current control manifest and submit evidence on the interval your policy sets. No manual screenshot gathering at quarter end.
One piece of evidence satisfies controls across SOC 2, ISO 27001 and DORA simultaneously. Map once, report many.
Every submission is timestamped and content-hashed. Evidence cannot be altered after filing, which is what auditors actually ask about.
Evidence is processed and stored in the United Kingdom. Regional pinning is available on all plans.
Two endpoints do the work. The contract does not change within a major version.
GET /api/v1/controls/manifest → current control set, JSON POST /api/v1/submissions → file evidence, JSON body