Your connections used to watch. Now they do the work.

More than scanning

One connection, several jobs

Most platforms connect to your tools to watch them. Ours put them to work. You choose each job during setup, and each one reports its own health, so a broken vendor sync never hides behind a healthy scan.

• Backlog. Findings land in Jira or Linear as tickets with the fix attached. Marking one Done starts the rescan.
• Vendor sync. New suppliers in Coupa or Zip enter your vendor review, and your decision is written back to procurement.
• Alerts. Drift, expiring access and approvals reach the right people in Slack or Teams.
• Fixes. On AWS, GitHub, Google Workspace and Entra ID, approved fixes are applied for you, then a rescan confirms they held.

Setup that proves itself

Know what we can read before you click Connect

Most setups end with a green tick and a surprise at audit time. Ours ends with an access check: one live call per permission, using the credential you just gave us. You see what came back, which checks each permission powers, and what to do about anything missing.

• Missing a permission? We name it, the checks it blocks, and the exact role or scope that adds it. No new token needed.
• Connect with what works today. 32 of 38 checks running beats waiting on an admin; the other 6 show as not evidenced, never as passing.
• If the vendor's plan doesn't include API access, we say so, instead of sending you to change roles that won't help.
• Federated roles for AWS, GCP and Azure. Short-lived credentials, no long-lived keys.
• Choose which jobs each connection does, so scanning doesn't have to come with ticketing, or the other way round.
• Choose whether it counts toward each audit (see Audit scope below).

Audit scope

Connect everything. Only what’s in scope counts.

No auditor has asked about MFA on your on-call tool, and none should see it fail on your SOC 2. Every connection is in or out of each assessment’s scope, so you can watch your whole stack without widening your audit.

• Set per assessment: in scope for SOC 2, out for HIPAA. It’s the last step of setup, and it’s editable any time.
• The same scope your assessment uses. Change it in either place and the other follows.
• Out-of-scope results stay visible, labelled “Out of scope”, and never reach that audit’s evidence or readiness.
• Every scope change is dated on the audit trail, so your auditor sees what was in scope for the whole window.

A catalog that tells you the truth

“Supported” should mean it worked for someone this morning

Every connection in the catalog shows how many customer tenants it's running on and when it last succeeded. New connections say they're new. And we run each one ourselves every day; if our own run fails, the card says so before you find out the hard way.

Fixing, not just finding

Write access is something you grant, not something we assume

Every connection starts read-only. When you want fixes applied for you, an admin issues a write grant on that connection: scoped to the changes it allows, with an expiry, and with a reason on record. Each fix it enables is still approved, and still verified by a rescan before it closes.

Health

One list of what needs you, and why

Expired tokens, a permission someone removed, a vendor plan that changed, or our own daily check failing. Each one says which checks it affects and the one thing to do about it. Evidence collected before the problem stays in the record.

Setup tells you before you finish. The access check makes one live call per permission and names anything missing, the checks it blocks, and the role or scope that adds it. You can connect with what works and add the rest later. Missing checks show as not evidenced, never as passing.