Evidence without screenshots
Built for audits such as ISAE 3402, SOC 2 and ISO/IEC 27001. The desk doesn’t make you compliant: it keeps the records, checks or enforces your controls and hands over the evidence.
How it works
A process control applies to the cases or incidents that match its conditions, and requires something before they are resolved: the customer’s approval, an approval from someone else, a second person, a property filled in, a time limit met or a review written. Each control is either enforced, so the desk won’t resolve until it is met, or checked and recorded.
Results are stored with the version of the control, and every exception needs an answer on record. Before you turn a control on, a preview shows how many records of the last 90 days would have met it.
An auditor picks a population and a period, such as every change in 2026, and exports it with a checksum. Then they draw a sample, at random with a seed anyone can use to draw the same sample again, or from their own list. The evidence pack is one ZIP with a PDF per record, an index with a SHA-256 per file and a README.
The Auditor role reads all of it without admin rights, and every read is logged. The audit log records sign-ins, settings, every write by an API token and every tool an AI assistant used, never the content of cases.
What it includes
Process controls
Conditions, a framework reference such as CC6.2 or A.5.18, In plain words, and a 90-day preview.
Approvals on cases
From the customer with a code sent by email, or from a colleague who is neither the assignee nor the one who asked.
Exceptions
Every record that didn’t meet a control, with the explanation.
Populations and samples
Exported with checksums, drawn with a repeatable seed, with change detection.
Evidence packs
A ZIP with a PDF per record, an index with checksums and a README.
Configuration snapshot
Roles, people, units, service levels, rules and controls as Excel or PDF, with conflicts of duties.
Export log
Every export with who, when, which filters, how many rows and its checksum.
Auditor role
Reads everything and changes nothing, with its reading logged.
